CVE-2024-3400: Palo Alto GlobalProtect Zero-Day with a Perfect CVSS 10.0 Score

TL;DR: CVE-2024-3400 is an unauthenticated OS command injection in Palo Alto Networks PAN-OS GlobalProtect with a perfect CVSS 10.0 score. Exploited as a zero-day by nation-state actor UTA0218 in Operation MidnightEclipse before any patch existed. Affects PAN-OS 10.2, 11.0, 11.1 with GlobalProtect enabled. Patch to 10.2.9-h1, 11.0.4-h1, or 11.1.2-h3 immediately.

A CVSS score of 10.0 is the absolute maximum in vulnerability severity — no authentication required, network-exploitable, complete system compromise. CVE-2024-3400 earned this perfect score in April 2024, making it one of the most critical vulnerabilities ever found in a network security device.

The product affected: Palo Alto Networks PAN-OS with the GlobalProtect feature — the very firewall and VPN infrastructure deployed by thousands of enterprises worldwide to protect their networks. When your firewall becomes the attack vector, everything behind it is at risk.

Vulnerability Overview

Affected Versions

Required condition: GlobalProtect Gateway or Portal must be enabled AND device telemetry must be enabled. Both conditions must be true for exploitation.

Technical Root Cause: Session ID Command Injection

The vulnerability is in how PAN-OS handles the session identifier (SESSID) during GlobalProtect authentication. PAN-OS uses the SESSID value in a file path construction that is passed to a shell command without proper sanitization of shell metacharacters.

The vulnerable path creates files in the GlobalProtect web server directory using the SESSID as part of the filename. Because the SESSID is embedded in a shell command without escaping, an attacker can inject arbitrary OS commands:

/* Conceptual illustration of the injection point */
/* Crafted SESSID sent during GlobalProtect auth — educational only */
SESSID: /../../../var/appweb/sslvpndocs/global-protect/portal/css/$(INJECTED_COMMAND)

/* The PAN-OS shell processes this SESSID and executes the injected command as root */
/* This happens BEFORE authentication is complete — pre-auth exploitation */

Because the vulnerable operation occurs during the authentication phase, before any credentials are verified, the attack requires zero authentication. Any attacker who can reach the GlobalProtect gateway or portal over the network can trigger command injection and gain root access to the PAN-OS device.

Zero-Day Exploitation: Operation MidnightEclipse

CVE-2024-3400 was actively exploited as a zero-day before Palo Alto Networks was even aware of the vulnerability. Cybersecurity firm Volexity discovered active exploitation and named the campaign Operation MidnightEclipse.

The threat actor, tracked as UTA0218, began exploiting this zero-day at least as early as March 26, 2024 — over two weeks before public disclosure on April 12, 2024. Volexity assessed UTA0218 to be a state-sponsored threat actor based on the tooling, operational security, and targeting patterns.

Malware Deployed by UTA0218

• UPSTYLE backdoor: A sophisticated Python-based backdoor that embedded itself inside a legitimate system file (bootstrap.min.css) to evade file-based detection. It monitored incoming web requests for embedded command strings. “Living in a legitimate file” makes it extremely hard to detect with standard security tools that whitelist known-good files.
• SIGTRAN: A lightweight tunneling tool for covert communication channels out of the compromised PAN-OS device
• LIGHTWIRE: A web shell providing persistent remote access through the GlobalProtect web interface
• LOWLIGHT: A passive backdoor providing persistent access that survives reboots

Post-Exploitation Attack Chain

1. Initial access: Exploit CVE-2024-3400 → root shell on PAN-OS device
2. Establish persistence: Deploy UPSTYLE inside bootstrap.min.css; install LOWLIGHT for boot persistence
3. Network pivot: Own the firewall → trusted access to everything on the internal network
4. Credential theft: Capture GlobalProtect VPN credentials for all authenticating users
5. AD attack: Move laterally to domain controllers; extract NTDS.dit (all AD password hashes)
6. Data exfiltration: Compress and exfiltrate sensitive data through tunneling tools

Indicators of Compromise

# Check for unexpected files in GlobalProtect web directories
find /var/appweb/sslvpndocs/ -newer /var/appweb/sslvpndocs/index.html -type f 2>/dev/null

# Look for Python processes (highly unusual on PAN-OS)
ps auxww | grep python

# Check for outbound connections from management plane
netstat -antp | grep ESTABLISHED

# Review recently modified CSS/JS files (UPSTYLE hides in these)
find /var/appweb/sslvpndocs/ -name "*.css" -newer /usr/lib/ssl -type f 2>/dev/null

File-based IOCs:

• Modified or new files in /var/appweb/sslvpndocs/global-protect/portal/css/
• Unexpected Python scripts in /tmp/ or /var/tmp/
• Modified bootstrap.min.css with appended or injected content
• Unexpected cron jobs in root’s crontab
• New listening services or unexpected open ports on the device

Patching and Remediation

Step 1 — Emergency Patch:

PAN-OS 10.2.x  →  Upgrade to 10.2.9-h1 or later
PAN-OS 11.0.x  →  Upgrade to 11.0.4-h1 or later
PAN-OS 11.1.x  →  Upgrade to 11.1.2-h3 or later

Step 2 — Temporary mitigations (if patching is not immediately possible):

1. Disable device telemetry: Device → Setup → Telemetry → Uncheck “Enable Telemetry” → Commit
2. Threat Prevention subscribers: Enable Threat ID 95187 in blocking mode

Step 3 — Compromise Assessment (even after patching):

1. Run Palo Alto’s enhanced Compromise Assessment Tool (via support portal)
2. Audit all files in GlobalProtect web directories for unauthorized modifications
3. Rotate ALL credentials accessible through the firewall — VPN users, admin accounts, service accounts
4. Review 30 days of firewall logs for unusual outbound connections from the management interface
5. Audit Active Directory for new privileged accounts or suspicious login events

Why This Is Uniquely Dangerous

CVE-2024-3400 represents a nightmare scenario — compromise of a security control. When attackers own your firewall they gain: full visibility into all traffic passing through it (including VPN tunnels terminated on the device), the ability to silently modify firewall rules, capture of all VPN user credentials, and a trusted network position for lateral movement. Traditional endpoint detection tools don’t run on firewall appliances, making this persistence nearly invisible to standard security monitoring.

Conclusion

CVE-2024-3400 is a landmark vulnerability: CVSS 10.0, pre-authentication, zero-day exploitation by nation-state actors, with devastating post-exploitation potential. For organizations that need help assessing potential compromise via CVE-2024-3400 or similar perimeter vulnerabilities, contact Vivek Verma for professional incident response or VAPT services.

Your firewall should protect you — not be weaponized against you.