CVE-2024-9463
HIGH KEV NUCLEIPalo Alto Networks Expedition 1.2.0-1.2.95 - Unauthenticated OS Command Injection
Title source: llmExploitation Summary
CVE-2024-9463 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 14, 2024. EIP tracks 1 public exploit from researchers including momo1239. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits a command injection vulnerability in an unspecified software's CSV-to-Parquet conversion endpoint to achieve remote code execution (RCE) via a reverse shell. It uses a crafted HTTP request to trigger payload execution and includes a local HTTP server to serve the malicious script.
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Exploits (1)
This PoC exploits a command injection vulnerability in an unspecified software's CSV-to-Parquet conversion endpoint to achieve remote code execution (RCE) via a reverse shell. It uses a crafted HTTP request to trigger payload execution and includes a local HTTP server to serve the malicious script.
Nuclei Templates (1)
http.favicon.hash:1499876150
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N