watchTowr may have successfully replicated CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 by Palo Alto Networks as an exploited zero-day, CWE-77: Command Injection; OS Command Injection Vulnerability in GlobalProtect Gateway, added to CISA KEV Catalog). Instead of releasing a Proof of Concept, they provided a "detection artefact generator tool" https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

@jullrich of SANS ISC warns that the widely shared GitHub exploit is almost certainly fake (cc: @mttaggart ) and two IP addresses were attempting CVE-2024-3400 exploitation: 173.255.223.159 and 146.70.192.174 https://isc.sans.edu/diary/rss/30838

Happy hotfix day from Palo Alto Networks who released 3 hotfixes for CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 as an exploited zero-day) with 15 more hotfixes expected in the coming days: https://security.paloaltonetworks.com/CVE-2024-3400

• PAN-OS 10.2:
  • 10.2.9-h1 (Released 14 April)
  • 10.2.8-h3 (ETA: 15 April)
  • 10.2.7-h8 (ETA: 15 April)
  • 10.2.6-h3 (ETA: 15 April)
  • 10.2.5-h6 (ETA: 16 April)
  • 10.2.3-h13 (ETA: 17 April)
  • 10.2.1-h2 (ETA: 17 April)
  • 10.2.2-h5 (ETA: 18 April)
  • 10.2.0-h3 (ETA: 18 April)
  • 10.2.4-h16 (ETA: 19 April)
• PAN-OS 11.0:
  • 11.0.4-h1 (Released 14 April)
  • 11.0.3-h10 (ETA: 15 April)
  • 11.0.2-h4 (ETA: 16 April)
  • 11.0.1-h4 (ETA: 17 April)
  • 11.0.0-h3 (ETA: 18 April)
• PAN-OS 11.1:
  • 11.1.2-h3 (Released 14 April)
  • 11.1.1-h1 (ETA: 16 April)
  • 11.1.0-h3 (ETA: 17 April)

It should come as no surprise that Palo Alto Networks did not release hotfixes* for affected versions of PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11 by the self-imposed deadline of Sunday 14 April 2024 like they estimated in their security advisory. 48 hours to develop/test/release is a tight delivery window with the whole infosec community breathing down their necks.

CISA put out an additional security alert about CVE-2024-3400, noting that Palo Alto Networks released workaround guidance for the command injection vulnerability. https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400

Just to make it easier to read through the various reports (saying almost the same exact thing), I've assembled a Palo Alto Networks zero-day MEGA list:

• Palo Alto Networks security advisory: CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway

UPDATE: Volexity and Unit 42 talk about the threat actor, campaign, and include indicators of compromise:

• Volexity: Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
• Unit 42: Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400

Here's the rest of the related reporting:

• Zscaler: Another CVE (PAN-OS Zero Day), Another Reason to Consider Zero Trust
• The Register: Zero-day exploited right now in Palo Alto Networks' GlobalProtect gateways
• Bleeping Computer:
  1. Palo Alto Networks warns of PAN-OS firewall zero-day used in attacks
  2. (update) Palo Alto Networks zero-day exploited since March to backdoor firewalls
• SANS ISC: Critical Palo Alto GlobalProtect Vulnerability Exploited (CVE-2024-3400)
• CERT-EU: Critical Vulnerability in PAN-OS software
• Qualys: PAN-OS OS Command Injection Vulnerability Exploited in the Wild (CVE-2024-3400)
• Rapid7: CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls
• The Hacker News:
  1. Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack
  2. (update) Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack
• Security Week:
  1. Palo Alto Networks Warns of Exploited Firewall Vulnerability
  2. (update) State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls
• SOCRadar: Critical OS Command Injection Vulnerability in Palo Alto's GlobalProtect Gateway: CVE-2024-3400. The patch is not available yet.
• CISA:
  1. CISA Adds One Known Exploited Vulnerability to Catalog
  2. Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400
• The Record: Palo Alto Networks warns of zero-day in VPN product
• Ars Technica:“Highly capable” hackers root corporate networks by exploiting firewall 0-day

Hot off the press! CISA adds CVE-2024-3400 (10.0 critical, disclosed 12 April 2024, PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway) to the Known Exploited Vulnerabilities (KEV) Catalog (to be updated later) https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Ivanti has a frequently asked questions (FAQ) blog post from 14 February 2024 addressing questions about their Ivanti Connect Secure, Policy Secure and ZTA gateway products. Important to note that "As of 14 February, Ivanti has a build available for all supported versions." It also responds to Eclypsium's claim of old open source code. They also dispute reporting that CVE-2024-22024 (8.3. high, disclosed 12 February by Ivanti) was being exploited after disclosure. "It is unfortunate that media reports continue to cover statements and unverified numbers from third parties that are incorrect or inflated." Ivanti officially responds to the accusations that they didn't credit watchTowr for reporting CVE-2024-22024. This reads like damage control for Ivanti's Public Relations.
https://www.ivanti.com/blog/key-faqs-related-to-ivanti-connect-secure-policy-secure-and-zta-gateway-vulnerabilities

Ivanti updated their knowledge base article with an available patch:

Update 1 February: A patch addressing all known vulnerabilities is now available for Ivanti Connect Secure version 22.5R2.2 and Ivanti Policy Secure 22.5R1.1.

https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Ivanti identified two new vulnerabilities (one actively exploited) in connection to the Ivanti Connect Secure zero-days from 10 January 2024. They are:

• CVE-2024-21888 (8.8 high) privilege escalation in web component "We have no evidence of customers being impacted by CVE-2024-21888 at this time"
• CVE-2024-21893 (8.2 high, exploited in the wild) sever side request forgery (SSRF) in the SAML component "At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted"

A patch is now available for Ivanti Connect Secure (versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1) and ZTA version 22.6R1.3.
https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
blog post: https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways
security advisory: https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US