14th December 2023
Summary
Yesterday Palo Alto Networks has published seven new security advisories. All seven vulnerabilities affect the PAN-OS software, including two Cross-Site Scripting (XSS) vulnerabilities.
Vulnerabilities
CVE-2023-6790 – DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface. A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface. CVSS 4.0: 7.5 (High)
CVE-2023-6791 – Plaintext Disclosure of External System Integration Credentials. A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface. CVSSv4.0: 6.1 (Medium)
CVE-2023-6794 – File Upload Vulnerability in the Web Interface. An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. CVSSv4.0: 5.9 (Medium)
CVE-2023-6792 – OS Command Injection Vulnerability in the XML API. An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. CVSSv4.0: 5.9 (Medium)
CVE-2023-6795 – OS Command Injection Vulnerability in the Web Interface. An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. CVSSv4.0: 5.9 (Medium)
CVE-2023-6793 – XML API Keys Revoked by Read-Only PAN-OS Administrator. An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage. CVSSv4.0: 5.1 (Medium)
CVE-2023-6789 – Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface. A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator. CVSSv4.0: 4.8 (Medium)
Palo Alto Networks is not aware of any malicious exploitation of any of these issues.
Recommendations
Customers are recommended to patch these vulnerabilities at the next maintenance window by upgrading to the latest version.
Mitigations
For some of the vulnerabilities Palo Alto Networks provides some mitigations and workarounds.
CVE-2023-6791, CVE-2023-6794, CVE-2023-6795, CVE-2023-6789
These issues require the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of the issues by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation.
CVE-2023-6792, CVE-2023-6793
These issues require the attacker to have authenticated access to the PAN-OS XML API. You can mitigate the impact of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation.
CVE-2023-6792
Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 91715 (introduced in Applications and Threats content update 8473).