Palo Alto Networks GlobalProtect Vulnerability: Impersonation of Authenticated Users

CVE-2024-8691

Summary

The vulnerability in the GlobalProtect portal of Palo Alto Networks PAN-OS software allows malicious actors, who are already authenticated GlobalProtect users, to impersonate other active users. When this occurs, the impersonated users are forcibly disconnected from the GlobalProtect service, thus compromising session integrity and disrupting connectivity. Furthermore, PAN-OS logs inaccurately indicate that the impersonated user has successfully authenticated, masking the attacker's identity and actions, creating challenges in monitoring and forensic analysis.

References