Network Firewalls, Network Access Control
,
Security Operations
No Patch Yet; Management Interface Lockdown Blunts Attacks, Networking Giant Says
Attackers are exploiting a zero-day vulnerability in the management interface of some types of Palo Alto Networks’ firewalls, the cybersecurity giant warned.
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the internet,” the company said late Thursday in a security alert.
Palo Alto said the flaw is being remotely exploited, has a “critical” severity rating of 9.3 out of 10 on the CVSS scale and that mitigating the vulnerability should be treated with the “highest” urgency.
One challenge for users: no patch is yet available to fix the vulnerability. Also, no CVE code has been allocated for tracking it. “As we investigate the threat activity, we are preparing to release fixes and threat prevention signatures as early as possible,” Palo Alto said. “At this time, securing access to the management interface is the best recommended action.”
The company said it doesn’t believe its Prisma Access or Cloud NGFW are at risk from these attacks.
Cybersecurity researchers confirm that real-world details surrounding the attacks and flaws remain scant. “Rapid7 threat intelligence teams have also been monitoring rumors of a possible zero-day vulnerability, but until now, those rumors have been unsubstantiated,” the cybersecurity firm said in a Friday blog post.
Palo Alto first warned customers on Nov. 8 that it was investigating reports of a zero-day vulnerability in the management interface for some types of firewalls and urged them to lock down the interfaces.
On Monday, the company published guidance to help customers access scans designed to discover any firewalls exposed via an internet-facing management interface.
In its Thursday security bulletin update, the company confirmed that active, in-the-wild attacks are underway, and that it is “actively investigating this activity.”
Pending a patch, the company has urged users to ensure they’ve implemented its mitigation advice. “In particular, we recommend that you immediately ensure that access to the management interface is possible only from trusted internal IPs and not from the internet. The vast majority of firewalls already follow this Palo Alto Networks’ industry best practice.”
That long-standing best-practice guidance from Palo Alto urges users to use an “out-of-band” management port for administering firewalls, including for its centralized management system Panorama.
“We understand that there are some scenarios where, instead of using the mgmt port, one would configure one of the data ports for mgmt access to the firewall,” the guidance reads. “Whatever your setup is, it is key to make it a hard target for the attackers and protect the firewall/Panorama and NEVER enable access to your mgmt interface from the internet or from other untrusted zones. This applies whether you use the dedicated management port (MGT) or you configure a data port as your management interface.”
Palo Alto said that for devices configured to restrict access to only trusted internal IPs, the vulnerability poses a lower risk of 7.5 on the CVSS scale – high but not critical – because “the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs.”
The company cautioned customers that attackers may have already exploited the flaw. For any organization that previously exposed firewall management interfaces to the internet, “we advise the customer to monitor for suspicious threat activity such as unrecognized configuration changes or users,” it said.
News of the zero-day flaw in an as-yet-unspecified number of Palo Alto Networks firewalls follows the discovery of other actively exploited, zero-day flaws in its products that came to light in April and July (see: CISA Warns of Active Attacks on Critical Palo Alto Exploit).