CVE-2024-9466 PoC — Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

Source

https://github.com/holypryx/CVE-2024-9466

Associated Vulnerability

Title:Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure (CVE-2024-9466)
Description:A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.

Description

CVE-2024-9466 poc

Readme

# CVE-2024-9466
CVE-2024-9466 Proof of Concept (PoC)

## Description

This script checks for the CVE-2024-9466 vulnerability by appending `/home/userSpace/devices/debug.txt` to a list of target URLs or IP addresses. It determines if the target is vulnerable based on the HTTP response status code and whether the request is redirected.

## Setup

Ensure that a `targets.txt` file exists in the same directory as the script. This file should contain a list of URLs or IP addresses to check, one per line. Example:
http://example.com
http://192.168.1.1

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!