PANW has published OS Command Injection Vulnerability in GlobalProtect, highest possible severity 10 – Critical.
https://security.paloaltonetworks.com/CVE-2024-3400
At the time of publishing, no fixes were available, but if firewall was configured according best practises, mitigation was out of the box. How? Let’s go into details.
Palo Alto Networks firewall has three types of security policies:
- Intrazone – to control traffic within zones
- Interzone – to control traffic between zones
- Universal – combine capabilities of two above. Security policies can be configured to control traffic within zones and between zones. Universal is default one.
Every firewall has two predefined security rules:
- Intrazone-default – by default traffic within the same zones is allowed
- Interzone-default – by default traffic between zones is blocked
Firewalls should be configured and maintained according golden rule, block by default, allow by design. With predefined rules traffic within the same zones is allowed, in my opinion is not desired behaviour and always at implementation beginning I configure rule type universal and action drop, at the end of rulebase, to block whole traffic, between zones and within zones.
How above applied to GlobalProtect vulnerability? Using such configuration approach, traffic to firewall itself is blocked – within the same zone. GlobalProtect traffic, from firewall perspective is from zone External to zone External (internet facing), so traffic within the same zone. Using only predefined rules, such communication is allowed, but like I mention, at the end of rulebase I always configure rule to drop everything, so GlobalProtect will be blocked as well. To allow , such rule need to be configure:
According best practices, every rule should have security profiles applied. Like seen above, security profiles were applied.
GlobalProtect Vulnerability
Recommended Mitigation: Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat ID 95187 and 95189 (available in Applications and Threats content version 8835-8689 and later).
As conclusion, if GlobalProtect was configured as above and Dynamic Updates were configured according best practises to download threat updates automatically as well, than firewall will automatically install newest Applications and Threats package and as outcome protection against critical vulnerability automatically is in place.
Of course, vulnerability is really critical, so definitely it is recommended to update devices, no question there.
I always say to my Customers, your security controls are as good as configuration quality. Simple example, but how powerful is proper configuration approach.