PAN-OS GlobalProtect RCE (CVE-2024-3400)

title: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection
id: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f
status: test
description: |
    Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect.
    This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.
references:
    - https://security.paloaltonetworks.com/CVE-2024-3400
    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
    - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-04-18
modified: 2025-11-22
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - cve.2024-3400
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: appliance
    product: paloalto
    service: globalprotect
    definition: 'Requirements: Palo Alto GlobalProtect "mp-log" and "gpsvc.log" log files need to be ingested'
detection:
    keywords_generic:
        - 'failed to unmarshal session(../'
        - 'failed to unmarshal session(./../'
        - 'failed to unmarshal session(/..'
        - 'failed to unmarshal session(%2E%2E%2F'
        - 'failed to unmarshal session(%2F%2E%2E'
        - 'failed to unmarshal session(%2E%2F%2E%2E%2F'
        - 'failed to unmarshal session(%252E%252E%252F'
        - 'failed to unmarshal session(%252F%252E%252E'
        - 'failed to unmarshal session(%252E%252F%252E%252E%252F'
    keywords_telemetry_exploit:
        - '{IFS}'
        - 'base64'
        - 'bash'
        - 'curl'
        - 'http'
    keywords_telemetry_path:
        - '/opt/panlogs/tmp/device_telemetry/'
    condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)
falsepositives:
    - Unknown
level: high

title: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation
id: bcd95697-e3e7-4c6f-8584-8e3503e6929f
status: test
description: |
    Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled.
    As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.
references:
    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3400
author: Andreas Braathen (mnemonic.io)
date: 2024-04-25
tags:
    - attack.execution
    - cve.2024-3400
    - detection.emerging-threats
logsource:
    product: paloalto
    service: globalprotect
    category: file_event
    definition: 'Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance'
detection:
    selection:
        TargetFilename|contains:
            - '{IFS}'
            - 'base64'
            - 'bash'
            - 'curl'
            - 'http'
        TargetFilename|startswith: '/opt/panlogs/tmp/device_telemetry/'
    condition: selection
falsepositives:
    - The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.
level: medium

sourcetype="pan:threat" threat_id IN (95187, 95189, 95191)
| stats count min(_time) as firstTime max(_time) as lastTime values(action) as action by src_ip dest_ip threat_id

CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor =~ "Palo Alto Networks"
| where DeviceEventClassID in ("95187", "95189", "95191") or AdditionalExtensions has_any ("95187", "95189", "95191")
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceAction

"failed to unmarshal session("
| regex("failed to unmarshal session\\((?<session_value>[^)]*)\\)")
| session_value!=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
| groupBy([session_value], function=count())

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Session Cookie Command Injection Attempt (CVE-2024-3400)"; flow:established,to_server; http.cookie; content:"SESSID="; startswith; content:"/opt/panlogs/tmp/device_telemetry/"; distance:0; fast_pattern; pcre:"/(?:\x60|\x7b).*(?:\x24\x7bIFS\x7d|\x2c)/R"; reference:cve,2024-3400; reference:url,labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/; reference:url,www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/; classtype:trojan-activity; sid:2052122; rev:2; metadata:affected_product Palo_Alto_Networks, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2024_04_16, cve CVE_2024_3400, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_17, reviewed_at 2024_10_04, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible UPSTYLE Command Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"img|5b|"; fast_pattern; pcre:"/img\x5b[a-zA-Z0-9+/=]{10,}\x5d/U"; content:!"|0d 0a|Referer|0d 0a|"; reference:url,www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/; reference:url,unit42.paloaltonetworks.com/cve-2024-3400/; classtype:trojan-activity; sid:2052026; rev:1; metadata:affected_product Palo_Alto_Networks, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2024_04_12, cve CVE_2024_3400, deployment Perimeter, deployment SSLDecrypt, malware_family UPSTYLE, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2024_04_12; target:dest_ip;)

rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
      author = "Florian Roth"
      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
      date = "2024-04-15"
      modified = "2024-04-18"
      score = 70
      id = "32cf18ff-784d-5849-87f8-14ede7315188"
   strings:
      $x1 = "cmd = base64.b64decode(rst.group"
      $x2 = "f.write(\"/*\"+output+\"*/\")"

      $x3 = "* * * * * root wget -qO- http://"
      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"

      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
      $x5b = "failed to unmarshal session(./../" // customer data

      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
      $x7 = "$(uname -a) > /var/" base64
   condition:
      1 of them
}