SOC274 — Palo Alto Networks PAN-OS Command Injection (CVE-2024–3400) | EventID: 249

Platform: LetsDefend

Rule: SOC274 — Palo Alto Networks PAN-OS Command Injection Vulnerability Exploitation (CVE-2024–3400) Event Time: Apr, 18, 2024, 03:09 AM EventID: 249 Severity: Critical Type: Web Attack Verdict: True Positive, Host Contained

Summary

A Critical-severity alert was triggered on April 18, 2024 at 03:09 AM when an attacker (144.172.79.92) exploited CVE-2024–3400, a command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect against PA-Firewall-01 (172.16.17.139, PAN-OS 10.2.0).

The attacker sent a crafted POST request to /global-protect/login.esp with a malicious payload embedded in the Cookie header. The payload executed on the firewall, launching dt_curl to attempt a callback to the attacker's listener on port 4444. The exfiltration attempt failed due to a DNS lookup error, but the code ran on the device, meaning the firewall was compromised. The host was subsequently contained.

Investigation

Step 1: Is Traffic Malicious?

The alert rule SOC274, CVE-2024–3400 describes a known critical vulnerability in Palo Alto PAN-OS GlobalProtect. One look at the raw log confirmed this wasn’t a false positive.

Step 2: Determine the Attack Type.

The attacker sent a POST request to /global-protect/login.esp with a payload injected via the Cookie header:

Two techniques stand out. First, Internal Field Separator is a classic Unix shell trick to bypass space filtering in command injection. Second, *whoami* executes as a subshell, sending the current user context back to the attacker's listener on port 4444. This is a reconnaissance callback, not a blind probe. T1059.004 (Command and Scripting Interpreter: Unix Shell).

Step 3: Check If It Is a Planned Test.

A quick check of the mailbox returned no planned work notifications. The source device showed no signs of attack simulation tooling as well. This was a real attack originating from the internet.

Step 4: What Is the Direction of Traffic?

The attacker at 144[.]172[.]79[.]92 targeted the internal firewall at 172[.]16[.]17[.]139 directly via the GlobalProtect login endpoint. This is T1190 (Exploit Public-Facing Application).

Step 5: Determine if the attack was successful.

Determining whether the attack was fully successful proved challenging. The key evidence is this log entry:

It proves that the payload was executed. dt_curl ran and attempted to transmit a file to the attacker's listener. The device processed the attacker's command. However, the final curl returned status 24 with a DNS lookup failure, meaning no confirmed data exfiltration occurred.

Endpoint Security’s Network Action tab showed an outbound connection from PA-Firewall-01 to 185[.]199[.]108[.]153 at 15:09:52, 10 seconds after the payload executed.

I checked 185[.]199[.]108[.]153 on VirusTotal. The IP belongs to Fastly, Inc. (AS54113) — a major legitimate CDN. 3/91 vendors flagged it as malicious, community score -26. Given that Fastly hosts hundreds of thousands of domains, this detection is low-confidence and not sufficient to confirm C2 activity on its own.

The connection to 185[.]199[.]108[.]153 (Fastly CDN) is noted but not confirmed as malicious given the low VirusTotal detection rate.

I marked the attack as successful based on code execution on the target device, not on whether data left the network. These are two different outcomes. Tier 2 escalation was requested for further confirmation.

Step 6: Containment

PA-Firewall-01 (172[.]16[.]17[.]139) was isolated via Endpoint Security containment.

Given that the attacker achieved code execution on a network firewall, containment alone is not sufficient. Full forensic analysis of the device is required to determine whether any configuration changes, backdoors, or persistent access mechanisms were established before containment. PAN-OS should be patched to a version that addresses CVE-2024–3400 immediately.

Kill Chain Summary

1. Attacker sends crafted POST request Source: 144[.]172[.]79[.]92[:]51232 → Destination: 172[.]16[.]17[.]139[:]20077 Payload injected via Cookie header to /global-protect/login.esp Apr 18, 2024 | 03:09 AM

2. Command injection executes on firewall The Internal Field Separator bypasses space filtering | whoami runs as subshell dt_curl launched on PA-Firewall-01 | 15:09:42

3. Callback attempt to C2 listener dt_curl attempts to reach 144[.]172[.]79[.]92[:]4444 DNS lookup failed — status 24 | 15:09:43

4. Host contained PA-Firewall-01 isolated via Endpoint Security Tier 2 escalation initiated

Lessons Learned

1. CVE-2024–3400 is trivially exploitable via a single HTTP request. The attacker needed nothing more than a crafted Cookie header. Public-facing network appliances running unpatched PAN-OS are exposed to this with zero user interaction required.

2. DNS failure is not the same as attack failure. The exfiltration attempt failed, but the payload still executed on the firewall. Code running on a network device is a compromise regardless of whether data left the network. These are two separate outcomes and must be treated as such during triage.

3. The Internal Field Separator is a red flag in any log. This trick is almost exclusively used to bypass filtering in command injection. Any log entry containing it warrants immediate investigation, as it is rarely accidental.

4. Firewalls are targets, not just defenses. Attackers actively seek to compromise network appliances because they sit at the edge, process all traffic, and are often trusted by the rest of the network. Patch management for perimeter devices must be treated as a top priority.

Written by *Tamerlan Shabanov | SOC Analyst | [Github](https://github.com/VelvetB1te)*