Palo Alto Networks Expedition SQL Injection Vulnerability Allowing Database Access and Arbitrary File Manipulation

A SQL injection vulnerability has been identified in Palo Alto Networks Expedition, allowing authenticated attackers to access the Expedition database. This includes sensitive information such as password hashes, usernames, device configurations, and device API keys for firewalls running PAN-OS. Additionally, this vulnerability enables attackers to create, read, and delete arbitrary files on the Expedition system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive database information and arbitrary file manipulation on the Expedition system.

Remediation

Users can update to Expedition version 1.2.101 or later to address this vulnerability. However, Expedition has reached its End of Life and is no longer supported, so users should consider transitioning to the suggested alternatives.