CVE-2021-3062

PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

Una vulnerabilidad de control de acceso inapropiada en el software PAN-OS permite a un atacante con acceso autenticado a los portales y puertas de enlace de GlobalProtect conectarse al endpoint de metadatos de la instancia EC2 para los firewalls VM-Series alojados en Amazon AWS. Una explotación de esta vulnerabilidad permite a un atacante llevar a cabo cualquier operación permitida por el rol EC2 en AWS. Este problema afecta a: PAN-OS versiones 8.1 anteriores a los firewalls VM-Series de PAN-OS 8.1.20; PAN-OS versiones 9.1 anteriores a los firewalls VM-Series de PAN-OS 9.1.11; PAN-OS versiones 9.0 anteriores a los firewalls VM-Series de PAN-OS 9.0.14; PAN-OS versiones 10.0 anteriores a los firewalls VM-Series de PAN-OS 10.0.8. Los clientes de Prisma Access no están afectados por este problema

*Credits: Palo Alto Networks thanks Matthew Flanagan of Computer Systems Australia (CSA) for discovering and reporting this issue.

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-06 CVE Reserved
2021-11-10 CVE Published
2023-06-03 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.paloaltonetworks.com/CVE-2021-3062	2022-07-25

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Paloaltonetworks Search vendor "Paloaltonetworks"	Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"	>= 8.1.0 < 8.1.20 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.1.0 < 8.1.20"	-	Affected	in	Paloaltonetworks Search vendor "Paloaltonetworks"	Vm-series Firewall Search vendor "Paloaltonetworks" for product "Vm-series Firewall"	-	-	Safe
Paloaltonetworks Search vendor "Paloaltonetworks"	Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"	>= 9.0.0 < 9.0.14 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.0.0 < 9.0.14"	-	Affected	in	Paloaltonetworks Search vendor "Paloaltonetworks"	Vm-series Firewall Search vendor "Paloaltonetworks" for product "Vm-series Firewall"	-	-	Safe
Paloaltonetworks Search vendor "Paloaltonetworks"	Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"	>= 9.1.0 < 9.1.11 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.1.0 < 9.1.11"	-	Affected	in	Paloaltonetworks Search vendor "Paloaltonetworks"	Vm-series Firewall Search vendor "Paloaltonetworks" for product "Vm-series Firewall"	-	-	Safe
Paloaltonetworks Search vendor "Paloaltonetworks"	Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"	>= 10.0.0 < 10.0.8 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 10.0.0 < 10.0.8"	-	Affected	in	Paloaltonetworks Search vendor "Paloaltonetworks"	Vm-series Firewall Search vendor "Paloaltonetworks" for product "Vm-series Firewall"	-	-	Safe