CVE-2020-2034

published 2020-07-08

CVE-2020-2034: An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with…

Priority P1 80 high 8.1 CVSS 3.1

AV N AC H PR N UI N S U C H I H A H

ITW VulnCheck KEV

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
palo_alto_networks	pan-os	—	—
palo_alto_networks	pan-os	—	—
palo_alto_networks	pan-os	>= 8.1 < 8.1.15	8.1.15
palo_alto_networks	pan-os	>= 9.0 < 9.0.9	9.0.9
palo_alto_networks	pan-os	>= 9.1 < 9.1.3	9.1.3
paloalto	pan-os	—	—
paloaltonetworks	pan-os	7.1.0 – 7.1.26	—
paloaltonetworks	pan-os	8.0.0 – 8.0.20	—
paloaltonetworks	pan-os	>= 8.1.0 < 8.1.15	8.1.15
paloaltonetworks	pan-os	>= 9.0.0 < 9.0.9	9.0.9
paloaltonetworks	pan-os	>= 9.1.0 < 9.1.3	9.1.3

Detection & IOCs extracted from sources · hover to see the quote

other Unique Threat ID 58658↗

• → The vulnerability exists in the PAN-OS GlobalProtect portal; only systems with the GlobalProtect portal feature enabled are exploitable — monitor/alert on unauthenticated inbound requests to the GlobalProtect portal interface. ↗
• → Attacker requires specific knowledge of the firewall configuration or may perform brute-force attempts prior to exploitation — look for high-volume or anomalous unauthenticated requests to the GlobalProtect portal as a precursor indicator. ↗
• → Apply Palo Alto Networks Threat Prevention signature for Unique Threat ID 58658 on traffic destined for the GlobalProtect portal to detect and block exploitation attempts. ↗

• · Firewalls already patched for CVE-2020-2021 (upgraded to latest PAN-OS versions at that time) are not vulnerable to this issue. ↗
• · Prisma Access deployments are not affected by this vulnerability. ↗
• · All versions of PAN-OS 8.0 and PAN-OS 7.1 are affected with no patched release available for those branches; upgrade to a supported branch is required. ↗

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

vulncheck 8.1 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78