CVE-2024-9464
MEDIUMPalo Alto Networks Expedition 1.2.0-1.2.95 - Authenticated OS Command Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-9464.
PoCs published by horizon3ai, Michael Heinzl, Zach Hanley, Enrique Castillo, Brian Hysell, including Metasploit module exploits/linux/http/paloalto_expedition_rce.
AI-analyzed exploit summary This PoC exploits CVE-2024-9464, an authenticated command injection vulnerability in Palo Alto Expedition. It chains with CVE-2024-5910 to reset admin credentials, then injects commands into a cronjob via the 'start_time' parameter.
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Exploits (2)
This PoC exploits CVE-2024-9464, an authenticated command injection vulnerability in Palo Alto Expedition. It chains with CVE-2024-5910 to reset admin credentials, then injects commands into a cronjob via the 'start_time' parameter.
This Metasploit module exploits CVE-2024-5910 (password reset) and CVE-2024-9464 (authenticated command injection) in Palo Alto Expedition to achieve remote code execution. It first resets the admin password if no credentials are provided, then leverages command injection in the cron job functionality.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N