PAN-OS: Vulnerabilidade de bypass de autenticação no Panorama

Successful exploitation of CVE-2020-2018 grants an attacker unauthorized privileged access to managed firewalls within a Palo Alto Networks environment. This could lead to complete compromise of the firewall, enabling attackers to modify security policies, exfiltrate sensitive data, and pivot to other systems within the network. The attacker requires some knowledge of the managed firewalls to exploit the vulnerability effectively. The blast radius extends to all managed firewalls connected to the vulnerable Panorama instance, potentially impacting the entire network infrastructure. This vulnerability shares characteristics with other privilege escalation flaws, where a lack of proper authentication checks allows unauthorized access to sensitive resources.

Organizations heavily reliant on Palo Alto Networks firewalls and Panorama for centralized management are particularly at risk. Environments with legacy PAN-OS versions (8.0 and earlier) and those lacking robust network segmentation are also highly vulnerable. Shared hosting environments utilizing Palo Alto firewalls should be especially vigilant, as they may be affected by vulnerabilities in the underlying infrastructure.

• paloalto / firewall:

Get-PanEvent | Where-Object {$_.type -eq "authentication" -and $_.severity -eq "critical"}

• paloalto / firewall:

Get-PanDevice | Where-Object {$_.version -lt "9.0.6"}

• paloalto / firewall:

Get-PanLog | Where-Object {$_.category -eq "system" -and $_.message -like "*context switching*"}

1. 2020-05-13Disclosure

   disclosure

2. 2020-05-13Patch

   patch

1. Reservado2019-12-04
2. Publicada2020-05-13
3. Modificada2024-09-16
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2020-2018 is to upgrade to PAN-OS version 9.0.6 or later. If an immediate upgrade is not feasible, Palo Alto Networks recommends implementing network segmentation to limit access to the Panorama management interface. Consider using a Web Application Firewall (WAF) or proxy to filter traffic and block suspicious requests targeting the context switching feature. Review and restrict access controls to the Panorama management interface, ensuring only authorized personnel can access it. For environments using custom certificates for communication between Panorama and managed devices, this vulnerability is not applicable. After upgrading, verify the fix by attempting to access the Panorama management interface from an unauthorized network location and confirming access is denied.