Palo Alto Patches critical flaws in Expedition tool exposing firewall credentials

Palo Alto Networks has released patches addressing multiple critical vulnerabilities in its Expedition tool, which is used for customer migration processes. Expedition is a migration tool that helps organizations streamline the process of transferring firewall configurations from other platforms, such as Cisco and Check Point, to Palo Alto's PAN-OS. Its purpose is to simplify and reduce the effort involved in migrating configurations,

These vulnerabilities, disclosed by Horizon3.ai allow potential attackers to gain control over firewall administrator accounts and access sensitive configuration data.

The critical flaws affect Expedition versions prior to 1.2.96 and include:

1. CVE-2024-9463 (CVSS score 9.9) - This OS command injection vulnerability enables an unauthenticated attacker to execute commands with root privileges on the Expedition system. This could result in access to usernames, cleartext passwords, API keys, and device configurations of PAN-OS firewalls.

2. CVE-2024-9464 (CVSS score 9.3) - An authenticated attacker can leverage this OS command injection flaw to execute commands as root, leading to similar data exposure as CVE-2024-9463.

3. CVE-2024-9465 (CVSS score 9.2) - This SQL injection vulnerability allows unauthenticated attackers to access Expedition's database contents, which include usernames and password hashes. Attackers can also create or read arbitrary files on the system, with proof-of-concept code for exploitation made publicly available.

4. CVE-2024-9466 (CVSS score 8.2) - This flaw involves cleartext storage of sensitive information, making it possible for authenticated attackers to access firewall usernames, passwords, and API keys.

5. CVE-2024-9467 (CVSS score 7.0) - A reflected cross-site scripting (XSS) vulnerability could allow malicious JavaScript execution within an authenticated user’s browser, potentially enabling phishing attacks or session hijacking.

These vulnerabilities can be exploited with low complexity, especially since they can provide attackers with access to critical firewall settings and administrative controls and one has an available PoC

Palo Alto Networks advises all customers to update to Expedition version 1.2.96 or later. They also recommend rotating Expedition usernames, passwords, and API keys, and restricting network access to authorized users only​.

While there is no evidence of active exploitation at the time of the disclosure, the availability of proof-of-concept code makes it crucial for users to patch their systems.