CVE-2024-5910
📋 TL;DR
CVE-2024-5910 is a critical authentication bypass vulnerability in Palo Alto Networks Expedition that allows unauthenticated attackers with network access to take over admin accounts. This exposes all configuration secrets, credentials, and sensitive data imported into Expedition. Organizations using Expedition for configuration migration and management are affected.
💻 Affected Systems
- Palo Alto Networks Expedition
📦 What is this software?
Expedition by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Expedition instance leading to theft of all stored credentials, configuration secrets, and sensitive network data, potentially enabling lateral movement to other systems.
Likely Case
Attackers gain administrative control of Expedition, access sensitive configuration data including firewall rules, VPN credentials, and administrative secrets.
If Mitigated
Limited impact if Expedition is isolated in a secure network segment with strict access controls and monitoring.
🎯 Exploit Status
Exploitation is trivial and has been observed in the wild. CISA has added this to their Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Expedition 2.3.24 and later
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2024-5910
Restart Required: Yes
Instructions:
1. Download Expedition 2.3.24 or later from Palo Alto support portal. 2. Backup current Expedition configuration. 3. Deploy the updated version. 4. Restart Expedition services. 5. Verify functionality.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Expedition to only trusted administrative networks
Use firewall rules to limit access to Expedition IP/port to specific source IPs
Access Control Lists
linuxImplement network ACLs to restrict access to Expedition management interface
iptables -A INPUT -p tcp --dport <expedition_port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <expedition_port> -j DROP
🧯 If You Can't Patch
- Immediately isolate Expedition from all non-essential networks using firewall rules
- Implement strict network segmentation and monitor all access attempts to Expedition
🔍 How to Verify
Check if Vulnerable:
Check Expedition version via web interface or CLI. Versions below 2.3.24 are vulnerable.Check Version:
Check web interface dashboard or use system information commands specific to Expedition deploymentVerify Fix Applied:
Verify version is 2.3.24 or higher in Expedition web interface or via system information commands📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to admin endpoints
- Unusual admin account creation or modification
- Access from unexpected source IPs
Network Indicators:
- Unusual traffic patterns to Expedition management interface
- Unauthenticated API calls to sensitive endpoints
SIEM Query:
source="expedition" AND (event_type="authentication_failure" OR event_type="admin_account_modified")