CVE-2024-3400 Explained: Palo Alto PAN-OS GlobalProtect Command Injection (CVSS 10.0)

GlobalProtect is Palo Alto's remote access VPN solution, integrated directly into PAN-OS and exposed on the internet-facing interface of the firewall. The vulnerability exists in how GlobalProtect processes the SESSID cookie value in HTTP requests sent to the gateway or portal endpoint.

PAN-OS takes the SESSID value and incorporates it into a shell command without sanitisation. By embedding OS command metacharacters (such as semicolons, backticks, or dollar-sign subshell expressions) into the cookie value, an attacker causes the firewall to execute arbitrary commands as the root user — the highest privilege level on the device. The command runs in the context of the PAN-OS management plane.

The attack requires no authentication token, no valid session, and no prior interaction with the device. Any HTTP request to the GlobalProtect endpoint with a malicious cookie value is sufficient. Because GlobalProtect is internet-facing by design, the attack surface is the public internet.

Volexity attributed the zero-day exploitation to UTA0218, a threat actor assessed with moderate confidence as state-sponsored based on the tradecraft, targets, and operational tempo observed. Targeted organisations included US government agencies, defence contractors, telecommunications providers, and critical infrastructure operators.

UTA0218's operational objectives during the zero-day window included exfiltrating PAN-OS configuration files containing firewall rules and plaintext credentials, deploying UPSTYLE for persistent access, harvesting Kerberos credentials via NTLM data accessible through the compromised device, and installing OpenSSH backdoors on internal systems reachable from the firewall. In several confirmed cases, UTA0218 pivoted from the compromised firewall to internal domain controllers within hours of initial compromise.

Patching the device closes the exploitation path but does not evict an already-present UPSTYLE backdoor or undo credentials and configurations already extracted. Remediation has three mandatory components.

Volexity and Unit 42 published IOC sets for UPSTYLE and UTA0218 infrastructure. Key detection points follow.

CVE-2024-3400 is the defining perimeter vulnerability of 2024. A CVSS 10.0 unauthenticated RCE in a firewall — the device that is supposed to be the first line of defence — is a category-level failure. The exploitation timeline is the most important lesson: UTA0218 had operational access to compromised networks for up to 17 days before any patch existed, during which they extracted configurations, pivoted to internal systems, and installed persistent backdoors.

Palo Alto is one of the most widely deployed enterprise firewall platforms in the world. If your organisation runs PAN-OS with GlobalProtect enabled and has not verified upgrade to the patched version, patching is the immediate priority. If you were running a vulnerable version during the pre-patch window, treat the device as compromised until you have completed an IOC investigation, rotated all referenced credentials, and confirmed the absence of UPSTYLE or similar backdoors. Patching alone is insufficient if the exploitation window was already used.