Palo Alto Networks Expedition OS Command Injection Vulnerability Allowing Arbitrary Command Execution as www-data User

A command injection vulnerability has been identified in Palo Alto Networks Expedition, specifically in versions prior to 1.2.101. This vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands as the www-data user. The exploitation of this vulnerability leads to the unauthorized disclosure of sensitive information, including usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution, with the potential to access and disclose sensitive information such as usernames, cleartext passwords, device configurations, and device API keys for PAN-OS firewalls.

Remediation

Users can upgrade to Expedition version 1.2.101 or later to address this vulnerability. However, it's important to note that Expedition has reached its End of Life and is no longer supported. Users are advised to transition to the suggested alternatives mentioned in the Expedition End of Life Announcement.