Palo Alto warns of a zero-day vulnerability in firewalls using GlobalProtect Portal VPN

Palo Alto Networks has disclosed a new zero-day vulnerability in GlobalProtect VPN that could be abused by an unauthenticated network-based attacker to execute arbitrary code on affected devices with root privileges.

Tracked as CVE-2021-3064 (CVSS score: 9.8), the flaw affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Massachusetts-based cybersecurity company Randori was credited with discovering and reporting it.

"The vulnerability chain consists of a method of bypassing validation performed by an external web server through HTTP smuggling, and a stack-based buffer overflow," Randori researchers said. "Exploitation has been demonstrated and allows remote code execution on both physical and virtual firewall products."

Technical details of CVE-2021-3064 have been withheld for 30 days to prevent threat actors from abusing it in real-world attacks.

The flaw arises from a buffer overflow when parsing user-supplied input. Successful exploitation requires chaining it with HTTP smuggling to achieve remote code execution on VPN installations, and network access to the device's GlobalProtect service on the default port, 443.

"A memory-corruption vulnerability in the Palo Alto Networks GlobalProtect portal and gateway interfaces allows an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges."

"A memory-corruption vulnerability in Palo Alto Networks GlobalProtect portal and gateway interfaces allows an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges," Palo Alto Networks said in a separate advisory. "The attacker must have network access to the GlobalProtect interface to exploit this issue."

Because VPN devices are lucrative targets for malicious actors, users are strongly advised to patch promptly. As a workaround, Palo Alto Networks advises affected organisations to enable threat signatures 91820 and 91855 for traffic destined for GlobalProtect gateway and portal interfaces to prevent attacks against CVE-2021-3064.