GlobalProtect App: Vulnerabilidade de Escalada de Privilégios (PE)

Successful exploitation of CVE-2024-2432 could allow a malicious local user to gain elevated privileges on a Windows system running the vulnerable GlobalProtect app. This could enable them to install malware, modify system configurations, access sensitive data, or compromise the integrity of the entire system. While exploitation requires a race condition, the potential impact is significant, as it bypasses standard user access controls. The attacker would need to be present on the machine and able to trigger the race condition, limiting the scope to local access.

Organizations deploying Palo Alto Networks GlobalProtect app on Windows devices are at risk. This includes environments with less restrictive local user account policies and those where local administrative access is frequently granted. Shared hosting environments utilizing GlobalProtect are also potentially vulnerable.

• windows / supply-chain:

Get-Process -ErrorAction SilentlyContinue | Where-Object {$_.ProcessName -like '*globalprotect*'}

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4688)] and EventData[Data[@Name='TargetUserName']='SYSTEM']" -MaxEvents 10

• windows / supply-chain: Check Autoruns for unusual entries related to GlobalProtect or suspicious executables running with elevated privileges (using tools like Autoruns from Sysinternals).

1. 2024-03-13Disclosure

   disclosure

1. Reservado2024-03-13
2. Publicada2024-03-13
3. Modificada2024-08-28
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-2432 is to upgrade the GlobalProtect app to version 6.2.1 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing stricter local user account controls and monitoring for suspicious process execution. While a direct workaround is not available, limiting the privileges of local user accounts can reduce the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to trigger the race condition and verifying that the elevated privilege execution is blocked.