Path Traversal in Palo Alto Networks Cortex XSOAR Engine

Executive Summary

This vulnerability is a path traversal flaw in the Palo Alto Networks Cortex XSOAR engine software running on Linux. It allows an unauthenticated attacker who is on an adjacent network and capable of performing a man-in-the-middle (MITM) attack to intercept and manipulate network response traffic. By exploiting this, the attacker can write arbitrary files to the host system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to write arbitrary files to the host system without authentication. This could lead to unauthorized modification or insertion of malicious files, potentially compromising the integrity and security of the affected system.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in Palo Alto Networks Cortex XSOAR engine software allows an unauthenticated attacker on an adjacent network to perform a man-in-the-middle (MITM) attack and write arbitrary files to the host. Detection involves monitoring for unusual network traffic indicative of MITM attacks or unexpected file writes on the host system.

Since the vulnerability requires interception and manipulation of network response traffic, network monitoring tools can be used to detect suspicious ARP spoofing or DNS poisoning attempts that facilitate MITM attacks.

On the host system, checking for unexpected or unauthorized file changes in the Cortex XSOAR installation directories may help detect exploitation attempts.

Specific commands are not provided in the available resources, but general suggestions include:

• Use network analysis tools like tcpdump or Wireshark to monitor for suspicious MITM activity.
• Use commands like 'find' or 'stat' on the Linux host to identify recently modified files in the Cortex XSOAR directories.
• Check system logs for unusual access or errors related to the Cortex XSOAR engine.

The best mitigation is to upgrade Cortex XSOAR to version 8.13.0.11 or later as recommended.

Useful 0 Not Useful 0

Mitigation Strategies

The suggested solution to mitigate this vulnerability is to upgrade Palo Alto Networks Cortex XSOAR engine software running on Linux to version 8.13.0.11 or later.

No special configuration is required for exposure, so applying the update is the primary mitigation step.

Useful 0 Not Useful 0