Back
SonicWall and Palo Alto Networks VPN Vulnerabilities: What You Need to Know

SonicWall and Palo Alto Networks VPN Vulnerabilities: What You Need to Know

WARNING Publication date: 2024-11-27

Background

Two critical vulnerabilities, CVE-2024-29014 in SonicWall's NetExtender VPN client and CVE-2024-5921 in Palo Alto Networks' GlobalProtect VPN client, have raised significant cybersecurity concerns. These flaws allow attackers to exploit users who connect to malicious VPN servers. Both companies have released security patches to address the vulnerabilities.

 

Details of the SonicWall Vulnerability (CVE-2024-29014)

The SonicWall vulnerability exists in the NetExtender VPN client for Windows, specifically version 10.2.339 and earlier. Attackers can exploit this flaw by pushing malicious updates to users connected to a rogue VPN server.

Once a user connects to a malicious VPN server, the attacker can:

  • Send a fake "update" signed with a valid code-signing certificate.
  • Execute arbitrary code on the user’s system with SYSTEM privileges.

For example, malicious actors might use social engineering to trick users into connecting to a fake VPN server. Once connected, the attacker deploys a malicious update, compromising the user's device.

Another attack vector involves the SonicWall SMA Connect Agent, which can start the VPN client via web requests. If a user visits a compromised website, the agent might establish a connection to a rogue server, enabling the attacker to send harmful updates.

For a detailed report on this CVE check out this link CVE-2024-29014 where you can consult our A.I. Assistant for a thorough understanding.

 

Details of the Palo Alto Networks Vulnerability (CVE-2024-5921)

The Palo Alto Networks vulnerability impacts the GlobalProtect VPN client on both macOS and Windows. Attackers can:

  • Steal login credentials.
  • Execute arbitrary code with elevated privileges.
  • Install a rogue root certificate, enabling further attacks.

To exploit this vulnerability, a user must first connect to a malicious VPN server. The attacker can then compromise the device. 

And again we have a detailed and annotated report on this vulnerability at CVE-2024-5921

 

How to Check if You Are Vulnerable

For SonicWall users, check the NetExtender version by running:

    netextendercli -v

Ensure your version is 10.2.341 or later. Older versions are vulnerable.

For Palo Alto Networks users, verify the GlobalProtect version with the following command:

    Get-Command GlobalProtect | Select-Object Version

Ensure your version is 6.2.6 or later.

 

Mitigation Steps

For SonicWall users:

  1. Update to NetExtender version 10.2.341 or higher.
  2. Avoid connecting to unknown VPN servers.
  3. Ensure automatic updates are enabled to receive future patches.

For Palo Alto Networks users:

  1. Update to GlobalProtect version 6.2.6 or later.
  2. Verify that your VPN portal uses valid TLS certificates.
  3. Follow Palo Alto Networks’ guidance to configure strict certificate validation.

 

Final Thoughts

These vulnerabilities highlight the critical importance of keeping VPN clients up-to-date and avoiding connections to untrusted servers. Organizations and users should apply the recommended patches immediately and review their network security practices to minimize exposure to such threats.

Source: Security.nl