New RCE on GlobalProtect if you didnt change the master key

[OtakarKlier]

Hello All,

I saw the below on twitter...

 

I wrote a tool to check master key configuration on palo alto firewalls and so far I haven't run into any instances of people actually changing the master key from p1a2l3o4a5l6t7o8

 

  

gist.github.com

check if a PAN firewall is using the default master key when globalprotect is enabled

check if a PAN firewall is using the default master key when globalprotect is enabled - checkmk.py

[kiwi]

Hi @OtakarKlier ,

Thanks for sharing this.

Adding the direct link from github:

https://gist.github.com/rqu1/6175cb2972291fc9ac96ef18f72b792c

Cheers,

-Kiwi.

[OtakarKlier]

Thanks @kiwi ,

Also changing the master key does not require a reboot so it can be done at anytime. Just remember to add it to your password manager, if lost you'll need a factory reset the device :(.

Regards,

[Usama-Ahmed]

This is old but got bubbled back up for me. Did we find out if this was the master key? 

Also, do we know if any PAN-OS update change the master key?

[OtakarKlier]

Hello,

You must change the master key manually. Also make sure to back it up.

Regards,

[Raido_Rattameister]

And if you have changed master key then don't forget to update it before it expires otherwise you need to reset your firewall to factory default.

"You must configure a new master key before the current key expires. If the master key expires, the firewall or Panorama automatically reboots in Maintenance mode. You must then Reset the Firewall to Factory Default Settings."

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/certificate-management/configure-the-mast...