Detecting Compromise of CVE-2024-3400 on Palo Alto Networks Global Protect Devices
Summary: Volexity reported in-the-wild zero-day exploitation of CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by a threat actor it tracks as UTA0218, which it assesses with moderate confidence is China-based. Palo Alto Networks released an advisory and threat protection signature within 48 hours of disclosure, and Volexity's follow-on investigations of customer tech support files identified malicious log entries in gpsvc.log, md_out.log, device_telemetry_send.log, syslog-system.log, and mp-monitor.log, including path traversal and command injection using echo, base64, and bash, plus crond entries running wget to fetch a payload from 172.233.228.93.
Why it matters: The exploit gives root access to the firewall, so the logs Volexity relies on can be tampered with by the adversary - which is why it recovered original entries from system memory, something Palo Alto Networks customers cannot currently collect on their own.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2024-3400
- Related
- Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in Global Protect (CVE-2024-3400) Cyber Risks ·CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 12, 2024