Palo Alto Networks GlobalProtect Session Fixation Vulnerability in SAML Authentication

A session fixation vulnerability has been identified in the GlobalProtect login when SAML authentication is used. This vulnerability allows an attacker to impersonate a legitimate user and perform actions on their behalf. The exploitation requires the user to click on a malicious link from the attacker. This issue does not affect the SAML login for the PAN-OS management interface, Cloud NGFW, or Prisma Access instances, which have been proactively patched.

Impact

Exploitation of this vulnerability allows for session fixation, enabling an attacker to impersonate a legitimate user and perform actions as that user within GlobalProtect.

Remediation

Users can upgrade to a fixed version of PAN-OS. For specific upgrade instructions, refer to the Palo Alto Networks documentation. As a workaround, consider using a different authentication method for the GlobalProtect portal, such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos.