PAN-OS: Panorama SD WAN arbitrary file creation

Vulnerability

An external control of filename vulnerability (CWE-73) exists in the SD WAN component of Palo Alto Networks PAN-OS Panorama. An authenticated administrator can send a crafted request that results in the creation and write of an arbitrary file on all firewalls managed by Panorama. This issue affects all versions of PAN-OS 7.1; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. PAN-OS 8.0 is end-of-life, and PAN-OS 7.1 is on extended support until June 30, 2020 [1].

Exploitation

An attacker must have valid administrative credentials to the Panorama management interface. The attacker sends a specially crafted request to the SD WAN component, controlling the filename and content. No user interaction is required, and the attack is performed over the network with low complexity [1].

Impact

Successful exploitation allows arbitrary file write on all managed firewalls, potentially leading to arbitrary code execution with root privileges on the firewalls. This can result in full compromise of the managed devices, affecting confidentiality, integrity, and availability (CVSSv3.1 Base Score 7.2) [1].

Mitigation

Fixed versions are PAN-OS 8.1.14 and 9.0.7, and all later versions. PAN-OS 7.1 and 8.0 do not have fixes and are not recommended for use. Workarounds include following best practices for securing the PAN-OS management interface, such as restricting access via IP whitelisting and using strong authentication [1].