topic Re: How can I see if my FW has already been exploited by the CVE-2024-3400? in General Topics

How can I see if my FW has already been exploited by the CVE-2024-3400?

Alpalo — Mon, 15 Apr 2024 13:59:27 GMT

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applying the WK,

Can anyone help me?

Greetings.

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

Adrian_Jensen — Mon, 15 Apr 2024 19:36:57 GMT

I have not seen anything yet for IoC in the logs as the exploit package apparently deletes related log entries. If you are syslogging then you may be able to search for something in your external log repository. I suspect there is probably a CLI debug command to show the Python packages loaded, but you would probably have to ask PA support for that. I have been running a script from an external server all weekend, constantly querying and validating the GlobalProtect CSS file, to look for any sign of an installed package.

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

TonyDeHart — Wed, 17 Apr 2024 16:41:34 GMT

If you haven't seen it the command from the CLI that can give indicators is in the advisory here: https://security.paloaltonetworks.com/CVE-2024-3400

From the advisory though it states this isn't definitive just could indicate a thwarted attempt and not necessarily a breach. We've uploaded tech support logs to Palo and are waiting for their analysis.

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

TonyDeHart — Wed, 17 Apr 2024 16:42:29 GMT

Also when you say FIXED be aware that disabling telemetry is NOT enough now and Palo's Guidance has changed on this as of late yesterday (4/16).

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

OtakarKlier — Thu, 18 Apr 2024 21:59:53 GMT

Hello All,

Here is the best writeup I have seen so far.

https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

Regards,

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

OtakarKlier — Fri, 19 Apr 2024 14:47:10 GMT

IOC's posted i made a new thread for it.

https://live.paloaltonetworks.com/t5/general-topics/cve-2024-3400-ioc-s/td-p/584343

Re: How can I see if my FW has already been exploited by the CVE-2024-3400?

OtakarKlier — Fri, 19 Apr 2024 14:58:33 GMT

Also PAN updated their Faq's with a search query.

https://security.paloaltonetworks.com/CVE-2024-3400#:~:text=Q.Are%20there%20any%20checks%20I%20can%20run%20on%20my%20device%20to%20look%20for%20evidence%20of%20attempted%20exploit%20activity%3F