Create CVE-2024-3400.yaml

[S4lt5]

Template / PR Information

• Added alternative method (no exfil, no timer) to detect unpatched Palo Alto GlobalProtect against CVE-2024-3400
• References:
  https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

Having run this on a lot of real world devices, I got a lot of negatives/passes on globalprotects based on:

• lack of ability to make outbound connections/exfil
• The fact that the /session/minute timer was on a longer timer such as 5min+ and that it would time out during the nuclei run.

The amount of hits I got via the file write, versus the existing template were greater than 10:1.

If you are looking for unpatched globalprotects, this should do the trick and be more reliable. Some of the positive hits you will get from this may be fully vulnerable to RCE as well, but it just takes some time, etc.

I'm not sure how to name this template, but I have validated it across a fairly wide set of devices.

Additional References:

[S4lt5]

I don't really know how to classify this, based on my real world experience this should show who is not patched to CVE-2024-3400 when there are mitigating factors to the interact-sh routine.

"In the wild" i have seen sites that take 5 mins or longer to call back after the payload is made, which passed the other script and may lead to false negatives.

[S4lt5]

@ehsandeep it looks good, I did some spot checks and seems to work well.

[W01fh4cker]

I don't really know how to classify this, based on my real world experience this should show who is not patched to CVE-2024-3400 when there are mitigating factors to the interact-sh routine.

"In the wild" i have seen sites that take 5 mins or longer to call back after the payload is made, which passed the other script and may lead to false negatives.

You are right, there will be a delay of almost five minutes, causing the original script to not be able to detect it correctly.

[GeorginaReeder]

Looks great, thanks for your contribution @S4lt5 - we appreciate it!

[fullstackpotato]

This newer poc is possibly not CVE-2024-3400, but a currently unassigned vuln in either golang's gorilla/sessions package/PA's own code elsewhere:

• x/vulndb: directory traversal in gorilla/sessions leads to file writes (and possible) reads in FilesystemStore golang/vulndb#2730
• Improve File System Path Handling gorilla/sessions#274

[W01fh4cker]

This newer poc is possibly not CVE-2024-3400, but a currently unassigned vuln in either golang's gorilla/sessions package/PA's own code elsewhere:

• x/vulndb: directory traversal in gorilla/sessions leads to file writes (and possible) reads in FilesystemStore golang/vulndb#2730
• Fix path traversal gorilla/sessions#274

You're right, but it can indeed be used to detect CVE-2024-3400

[S4lt5]

This newer poc is possibly not CVE-2024-3400, but a currently unassigned vuln in either golang's gorilla/sessions package/PA's own code elsewhere:

• x/vulndb: directory traversal in gorilla/sessions leads to file writes (and possible) reads in FilesystemStore golang/vulndb#2730
• Fix path traversal gorilla/sessions#274

This is true, it's not exactly the RCE, but is more of a "You are not patched for 2024-3400" which is why I was not sure how to classify this.

[TheLosingEdge]

Confirmed this as working

[schooldropout1337]

Thanks, got response after modification.