Threat Brief: Operation Midnight Eclipse, Post-Exploitation Activity Related to CVE-2024-3400 (Updated May 20)
Summary: Unit 42 is tracking exploitation of CVE-2024-3400, a command injection flaw with a CVSS score of 10.0 in PAN-OS 10.2, 11.0 and 11.1 firewalls configured with GlobalProtect gateway or portal, under the name Operation MidnightEclipse. The actor tried three times to install a Python backdoor called UPSTYLE, failed, and fell back to a cron job that fetched commands from an external server every minute, after copying configuration files such as running_config.xml to a web folder for exfiltration over HTTP.
Why it matters: A CVSS 10.0 flaw that lets an unauthenticated attacker run code as root on the firewall itself puts the device that guards the perimeter in the attacker's hands, and Unit 42 notes a proof of concept for persistence techniques that survive resets and upgrades. The actor's fallback cron job ran every minute against an external server, so a single missed firewall can become a standing channel for commands.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-3400
- Related
- CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 12, 2024