On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included a now-resolved crucial security weakness impacting Palo Alto Networks Expedition in its Known Vulnerabilities that Have Been Exploited (KEV) compilation, with proof of ongoing exploitation.
The identified vulnerability, known as CVE-2024-5910 (CVSS rating: 9.3), revolves around an instance of absent authentication in the Expedition transfer utility leading to a potential admin account seizure.
“There is a missing authentication vulnerability in Palo Alto Expedition that enables a malicious actor with network access to seize control of an Expedition admin account and potentially gain access to configuration secrets, credentials, and other crucial data,” as per a caution from CISA.
This deficiency impacts all prior versions of Expedition before version 1.2.92, which was released in July 2024 to address the issue.
There are no current reports on the exploitation methods of this vulnerability in real-world attacks, but Palo Alto Networks has subsequently adjusted its initial advisory to acknowledge that they are “informed by CISA about indications of ongoing exploitation.”
Also, included in the KEV compilation are two other weaknesses, one being a privilege elevation vulnerability in the Android Framework component (CVE-2024-43093), disclosed by Google this week as being subjected to “restricted, targeted exploitation.”
The second security flaw is CVE-2024-51567 (CVSS rating: 10.0), a crucial weakness affecting CyberPanel that allows a remote, unauthenticated attacker to run commands as root. This problem has been rectified in version 2.3.8.
In late October 2023, it was noted that the vulnerability was being widely exploited by malicious entities to deploy PSAUX ransomware on over 22,000 CyberPanel instances exposed on the internet, according to LeakIX and a security researcher known by the online handle Gi7w0rm.
LeakIX also highlighted that three distinct ransomware groups rapidly took advantage of the vulnerability, resulting in instances where files were encrypted multiple times.
The Federal Civilian Executive Branch (FCEB) agencies have been advised to address the identified vulnerabilities by November 28, 2024, in order to safeguard their networks from active threats.
About Author
