topic Re: How can I see if my FW has already been exploited by the CVE-2024-3400? in Advanced Threat Prevention Discussions

How can I see if my FW has already been exploited by the CVE-2024-3400?

Alpalo — Mon, 15 Apr 2024 13:54:53 GMT

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applying the WK,

Can anyone help me?

Greetings.

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

kristiansein — Wed, 17 Apr 2024 06:17:09 GMT

CVE has been updated with the instructions to do that: https://security.paloaltonetworks.com/CVE-2024-3400

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

YMueller — Wed, 17 Apr 2024 15:09:55 GMT

Hi All

Do these investigations have to be done running on the vulnerable software version, or is it still possible to check this after the software upgrade to a fixed release?

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

TonyDeHart — Wed, 17 Apr 2024 16:37:44 GMT

I worked with our team but not discussed this with Palo but my understanding is the logs should still show the information even after an upgrade. We just pushed the 10.2.9-h1 release out this morning after Palo changed their guidance regarding telemetry not being enough to stop this. We have the signatures but who knows what else they'll discover later that isn't mitigated without an upgrade.

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

TonyDeHart — Wed, 17 Apr 2024 16:39:28 GMT

I should mention that we are collecting logs via Panorama and externally. I just read in another post and hadn't noticed this in the write up that the vulnerability supposedly erases log entries...not sure how Palo is then analyzing logs in tech support files if the logs don't show the activity after the fact.