New RCE on GlobalProtect if you didnt change the master key

[OtakarKlier]

Hello All,

I saw the below on twitter...

 

I wrote a tool to check master key configuration on palo alto firewalls and so far I haven't run into any instances of people actually changing the master key from p1a2l3o4a5l6t7o8

 

  

gist.github.com

check if a PAN firewall is using the default master key when globalprotect is enabled

check if a PAN firewall is using the default master key when globalprotect is enabled - checkmk.py

[kiwi]

Hi @OtakarKlier ,

Thanks for sharing this.

Adding the direct link from github:

https://gist.github.com/rqu1/6175cb2972291fc9ac96ef18f72b792c

Cheers,

-Kiwi.

[OtakarKlier]

Thanks @kiwi ,

Also changing the master key does not require a reboot so it can be done at anytime. Just remember to add it to your password manager, if lost you'll need a factory reset the device :(.

Regards,