Palo Alto Networks PAN-OS Command Injection Attempt - CVE-2024-3400

The GlobalProtect VPN feature of Palo Alto Networks PAN-OS has a command injection vulnerability (CVE-2024-3400) that leads to remote code execution (RCE). An unauthenticated attacker sends a specially designed HTTP request that contains a malicious shell command instead of a valid SESSID cookie to the GlobalProtect web server. As a result, the GlobalProtect web server creates an empty file on the system with a malicious command as the filename. When device telemetry is enabled, a regularly scheduled system job runs the malicious command with root privileges, which enables the attacker to gain control of the device.