CVE-2017-15944
CRITICAL KEV NUCLEIPalo Alto Network PAN-OS - Remote Code Execution
Title source: nucleiExploitation Summary
CVE-2017-15944 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 18, 2022.
EIP tracks 8 public exploits from researchers including Metasploit, Philip Pettersson, surajraghuvanshi, including a Metasploit module exploits/linux/http/panos_readsessionvars.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks PAN-OS, including authentication bypass, XML injection, and cron job manipulation, to achieve root code execution. It stages a reverse TLS callback to deliver the payload, with execution triggered by a cron job running every 15 minutes.
Description
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
Exploits (8)
This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks PAN-OS, including authentication bypass, XML injection, and cron job manipulation, to achieve root code execution. It stages a reverse TLS callback to deliver the payload, with execution triggered by a cron job running every 15 minutes.
This is a detailed writeup describing three separate bugs in Palo Alto Networks firewalls that can be chained to achieve unauthenticated remote root code execution. The bugs include an authentication bypass, arbitrary directory creation, and a command injection in a cron script.
This repository contains a detection script and an exploit for CVE-2017-15944, a remote code execution vulnerability in Palo Alto Networks PAN-OS. The exploit leverages a command injection flaw in the `cms_changeDeviceContext.esp` endpoint to create a session and verify vulnerability via a debug console.
This PoC checks for CVE-2017-15944, a remote code execution vulnerability in Palo Alto Networks firewalls. It attempts to exploit a session manipulation flaw to verify if the target is vulnerable by checking for a debug console response.
This repository contains a README file describing CVE-2017-15944, a vulnerability affecting Palo Alto PAN-OS versions up to 6.1.18, 7.0.18, 7.1.14, and 8.0.5. No exploit code or technical details are provided.
This repository contains a working exploit for CVE-2017-15944, targeting a vulnerability in Palo Alto Networks PAN-OS. The exploit leverages a command injection flaw to achieve remote code execution (RCE) via a reverse shell.
This repository contains a functional exploit for CVE-2017-15944, targeting Palo Alto Networks PAN-OS. The exploit leverages a command injection vulnerability to achieve remote code execution (RCE) via a reverse shell.
This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks PAN-OS, including authentication bypass, XML injection, and cron job manipulation, to achieve root code execution. It stages a reverse TLS callback to deliver the payload, with execution triggered by a cron job running every 15 minutes.
Nuclei Templates (1)
http.favicon.hash:"-631559155" || cpe:"cpe:2.3:o:paloaltonetworks:pan-os"
icon_hash="-631559155"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H