CVE-2022-0024
📋 TL;DR
This vulnerability in Palo Alto Networks PAN-OS software allows authenticated administrators to upload malicious configurations that can disrupt system processes and potentially execute arbitrary code with root privileges when committed. It affects PAN-OS 8.1 through 10.1 on hardware and virtual firewalls, but not Panorama appliances or Prisma Access customers.
💻 Affected Systems
- Palo Alto Networks PAN-OS
📦 What is this software?
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious administrator could gain root-level code execution on affected firewalls, potentially compromising the entire network security infrastructure.
Likely Case
An insider threat or compromised administrator account could upload malicious configurations to disrupt firewall operations or execute limited code.
If Mitigated
With proper access controls and configuration validation, the risk is limited to authorized administrators following proper change management procedures.
🎯 Exploit Status
Requires authenticated administrator access to upload and commit malicious configurations. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PAN-OS 8.1.23, 9.0.16, 9.1.13, 10.0.10, 10.1.5 or later
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2022-0024
Restart Required: Yes
Instructions:
1. Download appropriate PAN-OS patch version from Palo Alto support portal. 2. Upload to firewall via web interface or CLI. 3. Install patch via web interface or CLI. 4. Reboot firewall to complete installation.
🔧 Temporary Workarounds
Restrict Configuration Upload Access
allLimit administrator access to configuration upload functionality to only trusted personnel.
Implement Configuration Change Controls
allRequire multi-person approval for configuration changes and implement configuration validation before commit.
🧯 If You Can't Patch
- Implement strict access controls and monitoring for administrator accounts
- Require multi-factor authentication for all administrator accounts
🔍 How to Verify
Check if Vulnerable:
Check PAN-OS version via web interface (Device > Setup > Operations) or CLI with 'show system info'Check Version:
show system info | match versionVerify Fix Applied:
Verify PAN-OS version is at or above patched versions: 8.1.23, 9.0.16, 9.1.13, 10.0.10, or 10.1.5📡 Detection & Monitoring
Log Indicators:
- Unusual configuration uploads, especially from non-standard administrators or at unusual times
- Configuration commit failures or system process disruptions
Network Indicators:
- Unusual administrative access patterns to firewall management interfaces
SIEM Query:
source="pan-firewall" (event_type="CONFIG" AND (action="upload" OR action="commit")) | stats count by user, src_ip, action