Authentication Bypass in Palo Alto Prisma Access Agent for Windows

Executive Summary

This is an authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma Access Agent on Windows. It allows a local administrator to bypass security inspection and inject or intercept arbitrary network traffic. Only the Windows version is affected; Linux, macOS, iOS, Android, and Chrome OS versions are not impacted.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking the installed version of the Prisma Access Agent on Windows systems. Compare the version against 26.3 or later. If the version is below 26.3, the system is vulnerable. No specific commands are provided in the resources, but version checks can typically be done via system settings or package managers.

Useful 0 Not Useful 0

Impact Analysis

A local administrator could exploit this to bypass network security controls, potentially allowing them to send or receive unauthorized network traffic. This could lead to data leaks, unauthorized access, or network manipulation if the attacker has local admin rights.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized network traffic interception or injection. Bypassing security inspection may lead to data breaches or unauthorized access, which are key concerns under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Prisma Access Agent on Windows to version 26.3 or later to address the authentication bypass vulnerability in the network driver.

Useful 0 Not Useful 0