CVE-2024-5910
CRITICAL KEV NUCLEIPalo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
Title source: metasploitExploitation Summary
CVE-2024-5910 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 7, 2024.
EIP tracks 2 public exploits from researchers including ByteHunter, Michael Heinzl, Zach Hanley, Enrique Castillo, Brian Hysell, including a Metasploit module exploits/linux/http/paloalto_expedition_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets Palo Alto Networks Expedition versions 1.2 to 1.2.90.1 by sending a GET request to '/OS/startup/restore/restoreAdmin.php' to reset the admin password to 'paloalto'. It is a simple, reliable authentication bypass exploit.
Description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Exploits (2)
This exploit targets Palo Alto Networks Expedition versions 1.2 to 1.2.90.1 by sending a GET request to '/OS/startup/restore/restoreAdmin.php' to reset the admin password to 'paloalto'. It is a simple, reliable authentication bypass exploit.
This Metasploit module exploits CVE-2024-5910 (admin password reset) and CVE-2024-9464 (authenticated OS command injection) in Palo Alto Expedition. It first resets the admin password if no credentials are provided, then leverages an authenticated command injection in the 'start_time' parameter of the CronJobs.php endpoint to achieve RCE.
Nuclei Templates (1)
http.favicon.hash:1499876150
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H