Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

[Netdata1]

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

[PavelK · Accepted solution]

Hello @Netdata1

PAN-OS is not affected by this vulnerability. As per OSS listing: OSS Listing even latest PAN-OS is running OpenSSH 8.0p1, while this vulnerability affects versions 9.0p1 – 9.5p1.

Kind Regards

Pavel

[AkashThangavel]

Hi PavelK,

The KB article you provided contains a different CVE number. Please verify its accuracy. If the provided information is correct, kindly provide the rationale behind sharing that particular KB

regards,

Akash Thangavel

Network Security Engineer

[PavelK]

Hello @AkashThangavel

you are correct. The link for KB I provided was indeed incorrect. I have already edited my original post. Thank you for pointing this out!

Kind Regards

Pavel

[ivanemoore]

Where does the vulnerability say 9.0p1 – 9.5p1?   According to NIST, it is "OpenSSH before 9.6".

https://nvd.nist.gov/vuln/detail/CVE-2023-51385

[PavelK]

Hello @ivanemoore

thanks for post.

You can find details for CVE-2023-51385 here: https://www.cybersecurity-help.cz/vdb/SB2023121905. I had the same impression that anything below 9.6 is affected, however this does not seem to be case. In the past I opened a TAC ticket for this and could confirm that PAN-OS is not affected by this vulnerability.

Kind Regards

Pavel

[ivanemoore]

Interesting.  I got back this:

Our Team has performed assessment for CVE 2023-51385 on our PAN-OS versions 
The CVE is impacted PANOS 10.2  and above which includes 11.2, 11.1, 11.0 and 10.2 as Redhat mentioned it is affected to RHEL8 which is using for 10.2 and above.  We are also in the process of getting the fixes in each pan os trains.

[PavelK]

Hello @ivanemoore

thank you for update on this topic.

It looks like the information you shared is more up to date. Did Palo Alto mention whether they are going to list this vulnerability in security advisory?

Kind Regards

Pavel

[lukewalcher]

@PavelK and @ivanemoore:

The https://security.paloaltonetworks.com/PAN-SA-2024-0001 Security Advisory claims the following for CVE-2023-51385: "The ssh configuration file on PAN-OS does not contain the vulnerable configuration settings. Therefore, PAN-OS is not affected."

[ivanemoore]

So, basically, Palo Alto is conflicting with themselves and don't know what they heck they are saying.  Great.

[lukewalcher]

I would tend to believe the Palo Alto Networks Product Security Assurance team's assessment listed above, not least because a quick read of the OpenSSH fix for this CVE at https://www.openssh.com/txt/release-9.6 indicates it's only a vulnerability when a "ProxyCommand, LocalCommand directive or 'match exec' predicate reference[s] the user or hostname via %u, %h or similar expansion token..."

I'm trying to imagine a scenario where the PAN-OS implementation of OpenSSH would have ever wanted to use those directives/predicates in their conf file(s) anyway....

But I hear you on the discrepancy coming from different parts of the vendor's organization. If you wanted to be absolutely sure, you could open a new TAC case referencing the original case and some of the references above, and request clarification from TAC?