An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.
* Expedition reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .
Configurations
No special configuration is required to be affected by this issue.
Workarounds
Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.
Exploits
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Credits
finder
An independent security researcher working with SSD Secure Disclosure
finder
Advanced Research Team, CrowdStrike
Timeline
Event
Date
Initial publication
2025-01-08 17:00:00
Corrected the CVSS score to note that authentication is not needed
2025-01-15 00:30:00
Event: Initial publication
Date:2025-01-08 17:00:00
Event: Corrected the CVSS score to note that authentication is not needed
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.