HD MooreApr 17, 2024

The watchTowr folks published an in-depth article today covering the Palo Alto Networks unauthenticated RCE at: https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

Even more impressive is they also disclosed a zero-day directory traversal vulnerability in the #golang gorilla/sessions package (used far and wide). The gorilla vulnerability only applies to code using the FilesystemStore, but it is still likely to impact a huge range of products and services. A pull request to fix this is open at https://github.com/gorilla/sessions/pull/274

Huge thanks to @alizthehax0r and the watchTowr team as well as @moloch of Bishop Fox for co-discovery (and providing a fix for) of the gorilla/sessions bug.

Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)

Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by now-familiar news—a nation-state was exploiting a “sophisticated” vulnerability for full compromise in yet another enterprise-grade SSLVPN device. We’ve seen all the commentary around the certification process of these devices for certain

watchTowr Labs - Blog
Show threadJonathan YuApr 17, 2024
@hdm @alizthehax0r @moloch Wasn't that gorilla stuff unmaintained for awhile, too? So many of us rely on stuff in various states of disrepair, and we deserve all the consequences we get, since we're like raccoons rummaging through trash lol
Show threadHD Moore
@jawnsy @alizthehax0r @moloch new maintainers as of July last year, but most of the work has focused on `mux`. Hopefully they can merge + tag a new version for `sessions` soon!
Apr 17, 2024 at 4:03amWeb
Show threadRaven667Apr 17, 2024
@hdm @jawnsy @alizthehax0r @moloch I wasn't planning on staying up to research this but I hope there are some constraints on what is a valid session.ID that is being written as one of the other problems was encoding '`commands`' into the session cookie, it seems that session IDs are usually alphanumeric and some constraint could probably be enforced that excludes "$(`);[]&!{}" and other nonsense