Expedition Admin Account Takeover Risk Due to Missing Authentication

CVE-2024-5910

9.8CRITICAL

Key Information

Vendor: Palo Alto Networks
Status: Expedition
Vendor: CVE Published:; 10 July 2024

Badges

🔥 No. 1 Trending😄 Trended👾 Exploit Exists🟣 EPSS 96%📰 News Worthy

What is CVE-2024-5910?

CVE-2024-5910 is a significant security vulnerability found in Palo Alto Networks' Expedition tool, which is designed to assist organizations in configuration migration, tuning, and enrichment of their network security settings. This vulnerability arises from a missing authentication mechanism for a critical function within the software, potentially allowing unauthorized attackers with network access to take over admin accounts. The consequences of such an exploit could severely compromise an organization's security posture by exposing sensitive configuration data, credentials, and system secrets.

Technical Details

CVE-2024-5910 is characterized by its lack of necessary authentication controls that protect important administrative functions in Expedition. Attackers who gain network access could exploit this flaw to execute actions that would typically require administrative privileges. This vulnerability highlights the importance of robust authentication measures within enterprise-grade software to safeguard against unauthorized access and actions within critical security management tools.

Impact of the Vulnerability

Admin Account Takeover: The most immediate impact of this vulnerability is the potential for attackers to assume control of admin accounts within Expedition, granting them the authority to manipulate configurations and access sensitive data.
Exposure of Sensitive Data: Exploitation of this vulnerability may lead to the leakage of confidential configuration secrets, credentials, and other critical data imported into Expedition, increasing the risk of further compromises across the organization's network.
Increased Attack Surface: By enabling unauthorized access to a crucial security management tool, CVE-2024-5910 broadens the attack surface for malicious actors, possibly leading to additional exploits or attacks on interconnected systems and resources within the organization.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-5910 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Expedition < 1.2.92

News Articles

BleepingComputer

CVE-2024-5910 CVE-2024-9464

Palo Alto Networks warns of potential PAN-OS RCE vulnerability

Palo Alto Networks warned customers to restrict access to their next-generation firewalls because of a potential remote code execution vulnerability in the PAN-OS management interface.

1 month ago