Information Exposure in Palo Alto Networks GlobalProtect macOS App

Executive Summary

This vulnerability is an information exposure issue in the Palo Alto Networks GlobalProtect app on macOS. It allows a local user to discover the passcodes that are configured to disable, disconnect, or uninstall the GlobalProtect app.

Once the passcodes are known, the user can bypass normal restrictions and perform these actions even if the app's configuration would normally prevent them.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that a local user with limited privileges can gain the ability to disable, disconnect, or uninstall the GlobalProtect app by learning the passcodes.

This could lead to a loss of security controls provided by the GlobalProtect app, potentially exposing the system or network to unauthorized access or other security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes configured passcodes that control disabling, disconnecting, or uninstalling the GlobalProtect app on macOS to local users. Such exposure of sensitive system information could potentially lead to unauthorized actions that weaken security controls.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the exposure of sensitive configuration data could increase the risk of unauthorized access or disruption of security mechanisms, which may impact an organization's ability to maintain compliance with data protection and security requirements.

Mitigations such as upgrading to patched versions or disabling the vulnerable setting can reduce this risk and help maintain compliance with security best practices required by such regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a local user on macOS discovering configured passcodes in the Palo Alto Networks GlobalProtect app. Detection would primarily involve checking the configuration settings on the GlobalProtect Portal and the version of the GlobalProtect app installed on macOS systems.

Specifically, verify if the GlobalProtect app versions 6.3.0 through 6.3.3 or 6.2.0 through 6.2.8-h1 are installed on macOS endpoints.

Also, check the GlobalProtect Portal configuration to see if the setting "Allow User to Uninstall GlobalProtect App" is set to "Allow with Password," which enables this vulnerability.

While no explicit commands are provided in the resources, you can use macOS commands to check the installed GlobalProtect app version, such as:

• ```bash /usr/local/bin/globalprotect version ```

To check the configuration on the GlobalProtect Portal (PAN-OS or Panorama), you would need to access the management interface and review the setting for uninstall permissions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include either upgrading the GlobalProtect app on macOS to patched versions or changing the vulnerable configuration setting on the GlobalProtect Portal.

• Upgrade to GlobalProtect App version 6.3.3-h1 or later if using the 6.3 branch.
• Upgrade to GlobalProtect App version 6.2.8-h2 or later if using the 6.2 branch.
• Alternatively, disable the vulnerable setting by changing "Allow User to Uninstall GlobalProtect App" from "Allow with Password" to "Disallow" in the GlobalProtect Portal configuration.

These steps prevent local users from discovering the passcodes that allow disabling, disconnecting, or uninstalling the GlobalProtect app.

Useful 0 Not Useful 0