Palo Alto Networks PAN-OS File Creation - CVE-2024-3400

The GlobalProtect VPN feature of Palo Alto Networks PAN-OS has a vulnerability that enables an attacker to create an empty file on the vulnerable system with an embedded command in the filename. This vulnerability can be chained with a command injection vulnerability (CVE-2024-3400), which leads to remote code execution (RCE) with root privileges. To create an empty file, an unauthenticated attacker sends a specially designed HTTP request that contains a malicious shell command instead of a valid SESSID cookie to the GlobalProtect web server. As a result, the GlobalProtect web server creates an empty file on the system with the malicious command as the filename.