CVE-2024-3400 — Palo Alto PAN-OS GlobalProtect Command Injection

Key facts

CVE-2024-3400 is a Critical (10.0) vulnerability: Palo Alto PAN-OS GlobalProtect Command Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-04-12), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2024-3400 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-04-12), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2024-04-19. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2024-3400
Severity	Critical (10.0)
CISA KEV	Actively exploited (added 2024-04-12) · ransomware
Product	Palo Alto Networks PAN-OS GlobalProtect
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-3400/

Details

CVE-2024-3400 (Palo Alto Networks PAN-OS GlobalProtect) is a Critical (10.0) vulnerability: Palo Alto PAN-OS GlobalProtect Command Injection. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Attribute	Value
CVE ID	CVE-2024-3400
CVSS Score	10.0 (Critical)
Product	Palo Alto Networks PAN-OS GlobalProtect
Type	Command Injection / RCE
CWE	CWE-77 (Improper Neutralization of Special Elements in Command)

Description

Critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software that allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. The vulnerability exists in the SESSID cookie processing within the SSL VPN functionality.

Affected Versions

• PAN-OS 11.1 < 11.1.2-h3
• PAN-OS 11.0 < 11.0.4-h1
• PAN-OS 10.2 < 10.2.9-h1

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: GlobalProtect Detection (Passive)

[*] Query /global-protect/portal/css/login.css
[*] Query /ssl-vpn/hipreport.esp
[*] Detect GlobalProtect and extract PAN-OS version

Step 2: Active Command Injection Testing

Method	Description	Detection
Path Traversal	Tests SESSID cookie with /../../../tmp/	Server processes traversal path
Timing-based	Injects $(sleep 3) via SESSID	Response delayed by ~3 seconds
Error-based	Injects $(id) and checks response	Command output (uid=, gid=) in response
OOB Callback	Injects $(curl callback)	HTTP request received at callback server

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    GlobalProtect Detection                   │
│  GET /global-protect/portal/css/login.css                   │
│  GET /ssl-vpn/hipreport.esp                                 │
│  Extract PAN-OS version → Check if < 11.1.2-h3             │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Command Injection Testing               │
│                                                              │
│  1. Path Traversal Test                                      │
│     └─ Cookie: SESSID=/../../../tmp/test                    │
│     └─ If server processes path → Likely vulnerable         │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Cookie: SESSID=/../../../tmp/$(sleep 3)              │
│     └─ If response_time > baseline + 3s → CONFIRMED         │
│                                                              │
│  3. Error-based Test                                         │
│     └─ Cookie: SESSID=/../../../tmp/$(id)                   │
│     └─ If "uid=" in response → CONFIRMED                    │
│                                                              │
│  4. OOB Callback Test                                        │
│     └─ Cookie: SESSID=/../../../tmp/$(curl callback)        │
│     └─ Check callback server for request → CONFIRMED        │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://vpn.target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://vpn.target.com -c --version-only

# With OOB callback (most reliable detection)
python3 poc.py -t https://vpn.target.com -c --callback http://your-server.com/cve2024

Expected Output (Vulnerable)

============================================================
CVE-2024-3400 - PAN-OS GlobalProtect Command Injection
CVSS: 10.0 (Critical) | Affects: PAN-OS 10.2/11.0/11.1
============================================================

[*] Target: https://vpn.target.com
[*] Step 1: Detecting PAN-OS GlobalProtect...
[+] GlobalProtect feature detected
[*] Detected: PAN-OS 11.1.0
[!] Version 11.1.0 is in vulnerable range
[*] Step 2: Active command injection testing...
[*] Testing timing-based command injection...
[!] VULNERABLE - Time delay detected

============================================================
RESULTS
============================================================
[!] STATUS: VULNERABLE
[!] Method: timing_based
[!] Details: CONFIRMED: Time delay detected: baseline=0.52s, with payload=3.68s
[*] Version: PAN-OS 11.1.0

Mitigation

1. Apply patches immediately:
2. PAN-OS 11.1.2-h3 or later
3. PAN-OS 11.0.4-h1 or later

4. PAN-OS 10.2.9-h1 or later

5. Disable GlobalProtect if not required

6. Apply Threat Prevention signatures:

7. Threat ID 95187 (blocks exploitation attempts)

8. Monitor for IOCs:

9. Suspicious SESSID cookies with path traversal
10. Requests to /ssl-vpn/hipreport.esp

11. Files created in /var/appweb/sslvpndocs/

12. Network segmentation:

13. Limit exposure of GlobalProtect portal

References

• Palo Alto Security Advisory
• NVD Entry
• CISA Advisory

Detection and prevention

Ready-to-deploy defensive rules for CVE-2024-3400, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2024-3400 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-3400 - Palo Alto PAN-OS GlobalProtect Snort Detection Rules
# Severity: Critical (CVSS 10.0)

# Detect access to vulnerable hipreport.esp endpoint
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 PAN-OS Hipreport Endpoint Access";
    flow:to_server,established;
    content:"/ssl-vpn/hipreport.esp"; http_uri;
    classtype:web-application-attack;
    sid:202434001;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect command injection in SESSID cookie
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 Command Injection in SESSID Cookie";
    flow:to_server,established;
    content:"Cookie"; http_header;
    content:"SESSID="; http_header;
    pcre:"/SESSID=[^;]*(\.\.|`|;|\||&&|\$\()/Hi";
    classtype:web-application-attack;
    sid:202434002;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect path traversal in SESSID cookie
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 Path Traversal in SESSID Cookie";
    flow:to_server,established;
    content:"SESSID="; http_header;
    content:"../"; http_header;
    classtype:web-application-attack;
    sid:202434003;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect telemetry path exploitation
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 Telemetry Path Exploitation";
    flow:to_server,established;
    content:"SESSID="; http_header;
    content:"device_telemetry"; http_header;
    classtype:web-application-attack;
    sid:202434004;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect backtick command injection
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 Backtick Command Injection";
    flow:to_server,established;
    content:"/ssl-vpn/"; http_uri;
    content:"SESSID="; http_header;
    content:"|60|"; http_header;
    classtype:web-application-attack;
    sid:202434005;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect GlobalProtect reconnaissance
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 GlobalProtect Portal Reconnaissance";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/global-protect/portal"; http_uri;
    detection_filter:track by_src, count 10, seconds 60;
    classtype:attempted-recon;
    sid:202434006;
    rev:1;
    metadata:cve CVE-2024-3400, severity medium;
)

# Detect POST to hipreport with suspicious content
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-3400 Suspicious Hipreport POST";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ssl-vpn/hipreport.esp"; http_uri;
    content:"SESSID="; http_header;
    pcre:"/SESSID=[^;]*[^\w\-]/Hi";
    classtype:web-application-attack;
    sid:202434007;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

# Detect potential reverse shell callback
alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3400 Potential Reverse Shell from PAN-OS";
    flow:from_server,established;
    content:"/bin/sh"; nocase;
    classtype:trojan-activity;
    sid:202434008;
    rev:1;
    metadata:cve CVE-2024-3400, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-3400 - Palo Alto PAN-OS GlobalProtect YARA Detection Rules
 * Severity: Critical (CVSS 10.0)
 * Operation MidnightEclipse
 */

rule CVE_2024_3400_Exploit_Request {
    meta:
        description = "Detects CVE-2024-3400 PAN-OS exploitation requests"
        author = "Security Research"
        date = "2024-04-12"
        cve = "CVE-2024-3400"
        severity = "critical"
        operation = "MidnightEclipse"

    strings:
        // Vulnerable endpoint
        $uri1 = "/ssl-vpn/hipreport.esp" ascii wide nocase
        $uri2 = "/global-protect/" ascii wide nocase

        // SESSID cookie with command injection
        $cookie1 = "SESSID=" ascii wide nocase
        $cookie2 = "Cookie:" ascii wide nocase

        // Command injection patterns
        $inject1 = "/../../../" ascii wide
        $inject2 = "`" ascii wide
        $inject3 = "$(" ascii wide
        $inject4 = "&&" ascii wide
        $inject5 = "||" ascii wide
        $inject6 = ";id" ascii wide
        $inject7 = ";whoami" ascii wide

        // Telemetry path exploitation
        $path1 = "device_telemetry" ascii wide
        $path2 = "/opt/panlogs/tmp/" ascii wide

    condition:
        (any of ($uri*) and any of ($cookie*) and any of ($inject*)) or
        (any of ($cookie*) and any of ($path*))
}

rule CVE_2024_3400_Payload_Patterns {
    meta:
        description = "Detects payload patterns for CVE-2024-3400"
        author = "Security Research"
        date = "2024-04-12"
        cve = "CVE-2024-3400"
        severity = "critical"

    strings:
        // Commands commonly used in exploitation
        $cmd1 = "curl " ascii wide
        $cmd2 = "wget " ascii wide
        $cmd3 = "/bin/sh" ascii wide
        $cmd4 = "/bin/bash" ascii wide
        $cmd5 = "python -c" ascii wide
        $cmd6 = "nc -e" ascii wide
        $cmd7 = "mkfifo" ascii wide
        $cmd8 = "base64 -d" ascii wide

        // PAN-OS specific paths
        $pan1 = "/opt/pancfg/" ascii wide
        $pan2 = "/opt/panlogs/" ascii wide
        $pan3 = "/var/appweb/" ascii wide
        $pan4 = "running-config.xml" ascii wide

        // Context indicator
        $ctx = "SESSID" ascii wide nocase

    condition:
        $ctx and (2 of ($cmd*) or any of ($pan*))
}

rule CVE_2024_3400_Webshell {
    meta:
        description = "Detects webshells deployed via CVE-2024-3400"
        author = "Security Research"
        date = "2024-04-12"
        cve = "CVE-2024-3400"
        severity = "critical"

    strings:
        // Python webshell patterns (common for PAN-OS)
        $py1 = "import subprocess" ascii wide
        $py2 = "import socket" ascii wide
        $py3 = "import os" ascii wide
        $py4 = "os.popen" ascii wide
        $py5 = "subprocess.Popen" ascii wide
        $py6 = "exec(" ascii wide

        // Shell patterns
        $sh1 = "#!/bin/bash" ascii wide
        $sh2 = "#!/bin/sh" ascii wide
        $sh3 = "eval " ascii wide

        // Network indicators
        $net1 = "socket.socket" ascii wide
        $net2 = "connect((" ascii wide
        $net3 = "reverse" ascii wide nocase
        $net4 = "callback" ascii wide nocase

    condition:
        (3 of ($py*)) or
        (any of ($sh*) and any of ($net*))
}

rule CVE_2024_3400_Config_Exfil {
    meta:
        description = "Detects configuration exfiltration via CVE-2024-3400"
        author = "Security Research"
        date = "2024-04-12"
        cve = "CVE-2024-3400"
        severity = "critical"

    strings:
        // PAN-OS configuration files
        $config1 = "running-config.xml" ascii wide
        $config2 = "device_telemetry" ascii wide
        $config3 = ".pancfg" ascii wide
        $config4 = "shared/ssl-vpn" ascii wide

        // Exfiltration methods
        $exfil1 = "curl " ascii wide
        $exfil2 = "wget " ascii wide
        $exfil3 = "scp " ascii wide
        $exfil4 = "nc " ascii wide

        // Encoding for exfil
        $enc1 = "base64" ascii wide
        $enc2 = "gzip" ascii wide
        $enc3 = "xxd" ascii wide

    condition:
        any of ($config*) and (any of ($exfil*) or any of ($enc*))
}

rule CVE_2024_3400_Network_IOC {
    meta:
        description = "Network-based indicators for CVE-2024-3400"
        author = "Security Research"
        date = "2024-04-12"
        cve = "CVE-2024-3400"
        severity = "high"

    strings:
        // HTTP patterns
        $http1 = "POST /ssl-vpn/hipreport.esp" ascii wide
        $http2 = "GET /global-protect/" ascii wide

        // Malicious cookie patterns
        $mal1 = /SESSID=[^;]*\.\.\/\.\./ ascii
        $mal2 = /SESSID=[^;]*`[^`]+`/ ascii
        $mal3 = /SESSID=[^;]*\$\([^\)]+\)/ ascii

        // Response indicating success
        $resp1 = "200 OK" ascii wide

    condition:
        any of ($http*) and any of ($mal*)
}

:material-file-download: prevention/yara.yar

# CVE-2024-3400 - Palo Alto PAN-OS GlobalProtect Prevention Rules for Nginx
# Use as reverse proxy protection layer

# Block access to vulnerable GlobalProtect endpoints
location /ssl-vpn/ {
    # Block hipreport endpoint (primary attack vector)
    location ~* /ssl-vpn/hipreport\.esp {
        access_log /var/log/nginx/cve-2024-3400-attempts.log;
        return 403;
    }

    # Block requests with suspicious SESSID cookies
    if ($cookie_sessid ~* "(\.\./|`|;|\||\\$\(|<|>)") {
        return 403;
    }

    # Block path traversal in cookies
    if ($cookie_sessid ~* "\.\.\/") {
        return 403;
    }

    deny all;
}

# Block GlobalProtect portal endpoints
location /global-protect/ {
    # Only allow from trusted networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;

    # Block command injection patterns in all inputs
    if ($args ~* "(;|`|\||\\$\(|&&)") {
        return 403;
    }
}

# Block telemetry endpoints that were exploited
location ~* /device_telemetry/ {
    return 403;
}

# Cookie sanitization
map $cookie_sessid $sanitized_sessid {
    default $cookie_sessid;
    "~*(\.\./|`|;|\|)" "";
}

server {
    # Reject requests with command injection in cookies
    if ($http_cookie ~* "SESSID[^;]*(\.\./|`|;|\||\\$\(|&&)") {
        return 400;
    }

    # Block null bytes
    if ($http_cookie ~* "\x00") {
        return 400;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    # Rate limiting
    limit_req zone=globalprotect_limit burst=5 nodelay;
}

# Rate limit zone (add to http block)
# limit_req_zone $binary_remote_addr zone=globalprotect_limit:10m rate=10r/s;

:material-file-download: prevention/nginx.conf

# CVE-2024-3400 - Palo Alto PAN-OS GlobalProtect Prevention Rules for Apache HTTPD

# Enable required modules
# LoadModule rewrite_module modules/mod_rewrite.so
# LoadModule security2_module modules/mod_security2.so

# Block vulnerable SSL VPN endpoints
<LocationMatch "^/ssl-vpn/hipreport\.esp">
    Require all denied
    CustomLog /var/log/httpd/cve-2024-3400-blocked.log combined
</LocationMatch>

# Block GlobalProtect endpoints from external access
<LocationMatch "^/global-protect/">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
</LocationMatch>

# Block device telemetry path
<LocationMatch "^/device_telemetry/">
    Require all denied
</LocationMatch>

# ModSecurity Rules for CVE-2024-3400
<IfModule mod_security2.c>
    # Block hipreport.esp access
    SecRule REQUEST_URI "@contains /ssl-vpn/hipreport.esp" \
        "id:202434001,phase:1,deny,status:403,\
        msg:'CVE-2024-3400 PAN-OS Hipreport Endpoint Access',\
        logdata:'%{REQUEST_URI}',severity:CRITICAL"

    # Block command injection in SESSID cookie
    SecRule REQUEST_COOKIES:SESSID "@rx (\.\./|`|;|\||\$\(|&&|\x00)" \
        "id:202434002,phase:1,deny,status:403,\
        msg:'CVE-2024-3400 Command Injection in SESSID Cookie',\
        logdata:'Cookie: %{REQUEST_COOKIES.SESSID}',severity:CRITICAL"

    # Block path traversal in cookies
    SecRule REQUEST_COOKIES "@rx \.\.[\\/]" \
        "id:202434003,phase:1,deny,status:403,\
        msg:'CVE-2024-3400 Path Traversal in Cookie',\
        severity:CRITICAL"

    # Block telemetry path manipulation
    SecRule REQUEST_COOKIES:SESSID "@contains device_telemetry" \
        "id:202434004,phase:1,deny,status:403,\
        msg:'CVE-2024-3400 Telemetry Path Manipulation',\
        severity:CRITICAL"

    # Block GlobalProtect with suspicious cookies
    SecRule REQUEST_URI "@beginsWith /global-protect" \
        "id:202434005,phase:1,chain,deny,status:403,\
        msg:'CVE-2024-3400 GlobalProtect Suspicious Request'"
        SecRule REQUEST_COOKIES "@rx [\x00-\x1f`|;]" ""

    # Block shell metacharacters in any cookie
    SecRule REQUEST_COOKIES "@rx [|;&`$(){}<>]" \
        "id:202434006,phase:1,deny,status:403,\
        msg:'CVE-2024-3400 Shell Metacharacters in Cookie',\
        severity:HIGH"
</IfModule>

# Logging for security monitoring
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Cookie}i\"" cookie_log
CustomLog /var/log/httpd/cookie-access.log cookie_log

# Request restrictions
LimitRequestFieldSize 4094

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2024-3400?

CVE-2024-3400 is a Critical (10.0) vulnerability: Palo Alto PAN-OS GlobalProtect Command Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-04-12), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2024-3400?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-3400?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-3400 actively exploited?

Yes. CVE-2024-3400 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-04-12, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2024-04-19. Prioritise patching and deploy the detection and prevention rules above.

---

For authorized security testing and research only. See the full source and NVD record.