Palo Alto Networks Outlines Remediation for Critical PAN-OS Flaw Under Attack

Palo Alto Networks has shared remediation advice for a just lately disclosed critical security flaw impacting PAN-OS that has arrive less than active exploitation.

The vulnerability, tracked as CVE-2024-3400 (CVSS score: 10.), could be weaponized to get hold of unauthenticated remote shell command execution on vulnerable products. It has been resolved in multiple variations of PAN-OS 10.2.x, 11..x, and 11.1.x.

There is evidence to propose that the issue has been exploited as a zero-working day because at minimum March 26, 2024, by a danger cluster tracked as UTA0218.

The exercise, codenamed Operation MidnightEclipse, involves the use of the flaw to drop a Python-centered backdoor called UPSTYLE that’s capable of executing commands transmitted by means of specifically crafted requests.

The intrusions have not been joined to a recognised danger actor or group, but it is really suspected to be a point out-backed hacking crew given the tradecraft and the victimology observed.

The most current remediation tips made available by Palo Alto Networks is centered on the extent of compromise –

• Level Probe: Unsuccessful exploitation try – Update to the latest offered hotfix

• Stage 1 Examination: Proof of vulnerability remaining examined on the unit, such as the development of an empty file on the firewall but no execution of unauthorized instructions – Update to the hottest furnished hotfix

• Amount 2 Prospective Exfiltration: Signs where documents like “running_config.xml” are copied to a locale that is accessible by means of web requests – Update to the most recent offered hotfix and perform a Private Facts Reset

• Amount 3 Interactive access: Evidence of interactive command execution, this sort of as the introduction of backdoors and other destructive code – Update to the most recent offered hotfix and carry out a Manufacturing facility Reset

“Undertaking a personal information reset eradicates dangers of prospective misuse of gadget details,” Palo Alto Networks reported. “A manufacturing facility reset is recommended because of to proof of extra invasive threat actor exercise.”

Uncovered this report intriguing? Follow us on Twitter  and LinkedIn to study a lot more unique content we publish.

Some parts of this article are sourced from:
thehackernews.com