Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in Global Protect (CVE-2024-3400)
Summary: On April 10, 2024, Volexity identified zero-day exploitation of CVE-2024-3400, an unauthenticated OS command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect with a CVSS base score of 10.0, and observed identical exploitation at a second customer the following day by a threat actor it tracks as UTA0218. The actor created reverse shells, deployed a Python backdoor Volexity calls UPSTYLE, and exported firewall configuration data to move laterally, with evidence of exploitation dating back to March 26, 2024.
What you should know: A CVSS 10.0 unauthenticated flaw in an internet-facing firewall, exploited against multiple organizations before a fix expected April 14, 2024, means the perimeter device itself was the entry point - and Volexity notes that patching will not remediate an existing compromise.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2024-3400
- Related
- CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 12, 2024