Reflected XSS Vulnerability in Palo Alto Networks GlobalProtect PAN-OS

CVE-2025-0133

What is CVE-2025-0133?

CVE-2025-0133 is a reflected cross-site scripting (XSS) vulnerability identified in the GlobalProtect™ features of Palo Alto Networks’ PAN-OS® software. GlobalProtect is a security solution that provides secure access to applications and resources over a virtual private network (VPN). This particular vulnerability allows attackers to execute malicious JavaScript code in the web browsers of authenticated users when they interact with specially crafted links. Such exploitation can result in significant security risks, particularly with the potential for phishing attacks that target users' credentials. While the vulnerability does not compromise the functionality or configurations of the GlobalProtect system itself, it opens the door to attacks that could leverage the appearance of legitimacy associated with the GlobalProtect portal.

Potential Impact of CVE-2025-0133

1. Credential Theft: The primary threat posed by this vulnerability lies in its potential to facilitate phishing attacks. If an authenticated user clicks on a malicious link, attackers can steal sensitive login credentials, leading to unauthorized access to secure resources and applications.

2. Limited Confidentiality Risks: For users with Clientless VPN enabled, there is an inherent risk of credential exposure. This vulnerability can exacerbate those risks, particularly by allowing attackers to craft phishing links that appear to originate from the legitimate GlobalProtect portal.

3. Increased Phishing Risk: The ability to execute script in the context of a user’s session could lead to an increase in successful phishing attempts, heightening the overall risk of social engineering attacks that target enterprise environments relying on GlobalProtect for secure access.

News Articles

GBHackers News

CVE-2025-0133

Critical Vulnerability in Palo Alto GlobalProtect Gateway & Portal Enables Remote Code Execution

Reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks’ GlobalProtect gateway and portal features (CVE-2025-0133) has been disclosed.

1 month ago

References