Improper Input Validation in Palo Alto Networks GlobalProtect App

Executive Summary

This vulnerability is an improper input validation flaw in the Windows Pre-Logon Access Provider (PLAP) component of Palo Alto Networks' GlobalProtect app. It allows a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on affected Windows devices.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking the GlobalProtect app version on Windows devices. Use the command 'reg query HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect /v DisplayVersion' in Command Prompt to verify the installed version. Compare it against affected versions: 6.3 before 6.3.3-h14, 6.2 before 6.2.8-h13, or 6.0 before 6.0.15.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control over your Windows device with SYSTEM privileges, potentially stealing data, installing malware, or disrupting operations. It requires a MitM attacker to be present on the same network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution with SYSTEM privileges on affected Windows devices, which could lead to unauthorized access to sensitive data. Such access may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling data breaches or unauthorized disclosure of personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the GlobalProtect app to the latest patched versions (6.3.3-h14 or later, 6.2.8-h13 or later, or 6.0.15 or later). Alternatively, disable SAML authentication in Connect Before Logon or switch to pre-logon with machine certificates as temporary mitigations.

Useful 0 Not Useful 0