topic Re: New RCE on GlobalProtect if you didnt change the master key in General Topics

New RCE on GlobalProtect if you didnt change the master key

OtakarKlier — Wed, 03 Aug 2022 12:29:20 GMT

Hello All,

I saw the below on twitter...

I wrote a tool to check master key configuration on palo alto firewalls and so far I haven't run into any instances of people actually changing the master key from p1a2l3o4a5l6t7o8

Re: New RCE on GlobalProtect if you didnt change the master key

kiwi — Thu, 04 Aug 2022 09:03:34 GMT

Hi @OtakarKlier ,

Thanks for sharing this.

Adding the direct link from github:

https://gist.github.com/rqu1/6175cb2972291fc9ac96ef18f72b792c

Cheers,

-Kiwi.

Re: New RCE on GlobalProtect if you didnt change the master key

OtakarKlier — Fri, 12 Aug 2022 17:23:20 GMT

Thanks @kiwi ,

Also changing the master key does not require a reboot so it can be done at anytime. Just remember to add it to your password manager, if lost you'll need a factory reset the device :(.

Regards,

Re: New RCE on GlobalProtect if you didnt change the master key

Usama-Ahmed — Wed, 10 Jan 2024 17:35:26 GMT

This is old but got bubbled back up for me. Did we find out if this was the master key?

Also, do we know if any PAN-OS update change the master key?

Re: New RCE on GlobalProtect if you didnt change the master key

OtakarKlier — Fri, 12 Jan 2024 17:52:35 GMT

Hello,

You must change the master key manually. Also make sure to back it up.

Regards,

Re: New RCE on GlobalProtect if you didnt change the master key

Raido_Rattameister — Fri, 12 Jan 2024 19:22:51 GMT

And if you have changed master key then don't forget to update it before it expires otherwise you need to reset your firewall to factory default.

"You must configure a new master key before the current key expires. If the master key expires, the firewall or Panorama automatically reboots in Maintenance mode. You must then Reset the Firewall to Factory Default Settings."

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/certificate-management/configure-the-master-key