Palo Alto Networks Outlines Remediation for Critical PAN-OS Flaw Under Attack

Palo Alto Networks has shared remediation direction for a a short while ago disclosed critical security flaw impacting PAN-OS that has appear underneath active exploitation.

The vulnerability, tracked as CVE-2024-3400 (CVSS rating: 10.), could be weaponized to attain unauthenticated distant shell command execution on susceptible gadgets. It has been addressed in various variations of PAN-OS 10.2.x, 11..x, and 11.1.x.

There is evidence to recommend that the issue has been exploited as a zero-working day since at minimum March 26, 2024, by a threat cluster tracked as UTA0218.

The activity, codenamed Procedure MidnightEclipse, entails the use of the flaw to drop a Python-dependent backdoor termed UPSTYLE that’s capable of executing commands transmitted by means of specifically crafted requests.

The intrusions have not been connected to a regarded menace actor or group, but it truly is suspected to be a point out-backed hacking crew provided the tradecraft and the victimology observed.

The most up-to-date remediation tips provided by Palo Alto Networks is based mostly on the extent of compromise –

• Stage Probe: Unsuccessful exploitation endeavor – Update to the newest supplied hotfix

• Stage 1 Test: Proof of vulnerability being examined on the machine, which includes the generation of an empty file on the firewall but no execution of unauthorized instructions – Update to the most current furnished hotfix

• Stage 2 Probable Exfiltration: Indicators wherever data files like “jogging_config.xml” are copied to a site that is accessible by using web requests – Update to the most current delivered hotfix and accomplish a Personal Info Reset

• Amount 3 Interactive entry: Proof of interactive command execution, this kind of as the introduction of backdoors and other destructive code – Update to the most up-to-date supplied hotfix and accomplish a Manufacturing unit Reset

“Carrying out a personal facts reset gets rid of risks of opportunity misuse of gadget details,” Palo Alto Networks mentioned. “A factory reset is advised owing to evidence of additional invasive threat actor action.”

Discovered this posting attention-grabbing? Follow us on Twitter  and LinkedIn to study far more unique content we article.

Some elements of this post are sourced from:
thehackernews.com