PAN-OS GlobalProtect: Command Injection (CVE-2024-3400)

A perimeter firewall that fronts the corporate network started doing things a firewall has no business doing: reaching out to the internet on its own and opening sessions into the data center. Begin where the intrusion began, at the one service the device publishes to the outside world.

Before sending any real payload, a careful operator checks whether the target can even be exploited. One external address did exactly that against this device, leaving a quiet, almost-empty trace. Find who ran that test.

Reading and writing files is reconnaissance. Running a command is compromise. A later request crossed that line and made the firewall execute attacker-chosen code. Attribute the request that achieved it.

With code execution in hand, the attacker went straight for the most valuable thing on a firewall: its own configuration. Identify the file that was copied out and pulled down from the internet.

The attacker did not keep re-exploiting the box. They left something behind that listens for instructions and answers back, all over ordinary-looking web traffic. Determine where the firewall was talking to.

Owning a firewall is only a means to an end. With the stolen configuration in hand, the attacker turned the appliance into a launch point against the network it was meant to protect. Classify how they reached the next system, and map it to MITRE ATT&CK.