- A bug Palo Alto addressed last summer is being abused in the wild
- CISA added it to its KEV catalog, giving federal agencies a deadline to patch
- The bug can be abused to take over accounts and steal data
A critical bug found in Palo Alto Networks’ Expedition program is being abused in the wild, the US government has warned.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-5910 to its Known Exploited Vulnerabilities (KEV) catalog, which means there is evidence of abuse in the wild.
This vulnerability, discovered in Expedition in the summer of 2023, is described as a “missing authentication for a critical function” bug, which can lead to Expedition admin account takeover for crooks with network access. Since Expedition is a tool that helps with configuration migration, tuning, and enrichment, it may contain secrets, credentials, and other data, which would then be at risk of theft.
Proof of concept
Users are advised to apply a patch immediately, since the vulnerability allows threat actors to take over admin accounts, steal sensitive data, and more.
When CISA adds a vulnerability to KEV, it gives federal agencies a deadline to patch it, or stop using the afflicted applications completely. The due date for Palo Alto Networks Expedition is November 28, 2024.
CISA did not share any further details about the attacks, but BleepingComputer dug up a report from Horizon3.ai, who released a proof-of-concept exploit in October 2024. By chaining the bug with CVE-2024-9464, crooks could gain unauthenticated arbitrary command execution capabilities on vulnerable Expedition servers.
This additional vulnerability was also discovered, and patched, last month. Palo Alto Networks said it could have been used to take over admin accounts in firewalls, and take over PAN-OS instances.
For those unable to install the patch immediately, a workaround is available, which includes restricting Expedition network access to authorized users, hosts, and networks, only.
“All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating,” Palo Alto Networks concluded.
Via BleepingComputer
English