PAN-OS: Panorama authentication bypass vulnerability

Vulnerability

The vulnerability resides in the Panorama context switching feature and allows an attacker with network access to a Panorama management interface to bypass authentication and gain privileged access to managed firewalls. Affected versions: PAN-OS 7.1 earlier than 7.1.26, PAN-OS 8.1 earlier than 8.1.12, PAN-OS 9.0 earlier than 9.0.6, and all versions of PAN-OS 8.0. Panorama configured with custom certificates authentication for communication between Panorama and managed devices is not affected [1].

Exploitation

An attacker must have network access to the Panorama management interface and some knowledge of managed firewalls. No authentication or user interaction is required. The attack complexity is high because the attacker needs knowledge of the target firewalls, but no credentials are needed [1].

Impact

Successful exploitation gives the attacker privileged access to managed firewalls, potentially leading to complete compromise of confidentiality, integrity, and availability of the firewalls and the networks they protect (CVSSv3.1 Base Score 9.0, Critical) [1].

Mitigation

The issue is fixed in PAN-OS 7.1.26, PAN-OS 8.1.12, and PAN-OS 9.0.6 and later versions. Upgrading Panorama to a fixed version is sufficient. PAN-OS 8.0 is end-of-life as of October 31, 2019, and no longer covered by security policies. As a workaround, enable custom certificates authentication between Panorama and managed firewalls, and follow best practices for securing the PAN-OS management interface [1].