DaystoPatch

Palo Alto NetworksExploited incident

Expedition OS command injection and SQL injection exposing firewall credentials (PAN-SA-2024-0010)

CVE-2024-9463, CVE-2024-9465, CVE-2024-9464, CVE-2024-9466, CVE-2024-9467Critical, CVSS 9.9In CISA's Known Exploited Vulnerabilities catalog since 14 Nov 2024

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Palo Alto Networks bulletin PAN-SA-2024-0010 / CVE-2024-9463 (advisory page)CuratedQuote verified

    2024-10-09 Initial publication

    Coordinated disclosure with a fix; CISA reported exploitation in November 2024. Time from this timeline entry's data-date attribute (2024-10-09T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3441055f6e77c61f…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Palo Alto Networks advisory PAN-SA-2024-0010ClaimedQuote not found in archive9 Oct 2024, 16:00 UTC

    Palo Alto Networks is aware of reports from CISA that there is evidence of active exploitation for CVE-2024-9463 and CVE-2024-9465. More information can be found at https://www.cisa.gov/news-events/alerts/2024/11/14/cisa-adds-two-known-exploited-vulnerabilities-catalog . Weakness

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:a0d0f23780d4bd9b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-9463ClaimedQuote verified9 Oct 2024, 17:03 UTC

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:445c7cf65b7569f0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 Oct 2024, 07:13 UTC

    ID: CVE-2024-9463

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Oct 2024, 20:25 UTC

    Proof of concept to exploit CVE-2024-9465 on vulnerable Palo Alto devices was created not long ago. Please make sure to patch your systems!! https:// github.com/horizon3ai/CVE-2024 -9465 The advisory: https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-9463)ClaimedQuote verified14 Nov 2024

    Palo Alto Networks Expedition OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2024-11-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-9465)ClaimedQuote verified14 Nov 2024

    Palo Alto Networks Expedition SQL Injection Vulnerability

    Added to CISA's KEV catalog on 2024-11-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: quote not found in the archived copy

    Palo Alto Networks advisory PAN-SA-2024-0010ClaimedQuote not found in archive

    Palo Alto Networks is aware of reports from CISA that there is evidence of active exploitation for CVE-2024-9463 and CVE-2024-9465. More information can be found at https://www.cisa.gov/news-events/alerts/2024/11/14/cisa-adds-two-known-exploited-vulnerabilities-catalog . Weakness

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:a0d0f23780d4bd9b…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks bulletin PAN-SA-2024-0010 / CVE-2024-9463 (advisory page)CuratedQuote verified9 Oct 2024, 16:00 UTC

    2024-10-09 Initial publication

    Time from this timeline entry's data-date attribute (2024-10-09T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3441055f6e77c61f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks bulletin PAN-SA-2024-0010 / CVE-2024-9463 (advisory page)CuratedQuote verified

    If Expedition is not in active use, ensure that Expedition software is shut down.

    Later timeline entries (2024-10-09T22:32Z clarification; 2024-11-14T21:30Z exploitation status) did not concern mitigations, so the workaround is taken to be in the initial bulletin.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3441055f6e77c61f…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks bulletin PAN-SA-2024-0010 / CVE-2024-9463 (advisory page)CuratedQuote verified

    The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions.

    Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3441055f6e77c61f…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Palo Alto Networks bulletin PAN-SA-2024-0010 / CVE-2024-9463 (advisory page)CuratedQuote verified

    The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions.

    Single product line.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3441055f6e77c61f…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. PAN-SA-2024-0010

    Recorded in the revision history

    Expedition: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 7 Nov 2024, 17:10 UTC: archived copyLater version captured 15 Nov 2024, 12:11 UTC: archived copyRecovered from archived copiesSnapshots be11b42f02… and daea0b0019…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Palo Alto Networks Expedition (migration tool)
How we built this timeline

Bulletin PAN-SA-2024-0010 covers five Expedition CVEs (CVE-2024-9463 to -9467); KEV lists CVE-2024-9463 (OS command injection, CVSS 9.9) and CVE-2024-9465 (SQL injection; the per-advisory records also show CVSS 9.9) on 14 Nov 2024.

Exploitation status updated 14 Nov 2024 citing CISA. Fix predates exploitation, so exploited before a fix is false.

Related

Palo Alto Networks report card