A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of…

#!/usr/bin/env bash
# check-cve-2024-3400.sh
# Determine likely exposure to CVE-2024-3400 on a Palo Alto PAN-OS firewall.
# Usage: ./check-cve-2024-3400.sh <host> <api_key>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

HOST="${1:-}"
APIKEY="${2:-}"

if [[ -z "$HOST" || -z "$APIKEY" ]]; then
  echo "UNKNOWN - usage: $0 <host> <api_key>"
  exit 2
fi

fetch_api() {
  local type="$1"
  local payload_key="$2"
  local payload_val="$3"
  curl -sk --connect-timeout 10 --max-time 20 \
    --data-urlencode "type=${type}" \
    --data-urlencode "key=${APIKEY}" \
    --data-urlencode "${payload_key}=${payload_val}" \
    "https://${HOST}/api/"
}

extract_tag() {
  local tag="$1"
  sed -n "s:.*<${tag}>\([^<]*\)</${tag}>.*:\1:p" | head -n1
}

version_tuple() {
  # Convert PAN-OS version like 11.1.2-h3 into four integers: major minor maint hotfix
  local v="$1"
  if [[ "$v" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-h([0-9]+))?$ ]]; then
    local a="${BASH_REMATCH[1]}"
    local b="${BASH_REMATCH[2]}"
    local c="${BASH_REMATCH[3]}"
    local d="${BASH_REMATCH[5]:-0}"
    echo "$a $b $c $d"
    return 0
  fi
  return 1
}

is_at_least() {
  # Usage: is_at_least current target
  local cur target
  cur=( $(version_tuple "$1") ) || return 1
  target=( $(version_tuple "$2") ) || return 1
  local i
  for i in 0 1 2 3; do
    if (( cur[i] > target[i] )); then return 0; fi
    if (( cur[i] < target[i] )); then return 1; fi
  done
  return 0
}

is_patched_version() {
  local v="$1"
  local t
  t=( $(version_tuple "$v") ) || return 2
  local major="${t[0]}"
  local minor="${t[1]}"
  local maint="${t[2]}"

  # PAN-OS 10.2 hotfix matrix from vendor advisory
  if [[ "$major.$minor" == "10.2" ]]; then
    case "$maint" in
      0) is_at_least "$v" "10.2.0-h3"; return $? ;;
      1) is_at_least "$v" "10.2.1-h2"; return $? ;;
      2) is_at_least "$v" "10.2.2-h5"; return $? ;;
      3) is_at_least "$v" "10.2.3-h13"; return $? ;;
      4) is_at_least "$v" "10.2.4-h16"; return $? ;;
      5) is_at_least "$v" "10.2.5-h6"; return $? ;;
      6) is_at_least "$v" "10.2.6-h3"; return $? ;;
      7) is_at_least "$v" "10.2.7-h8"; return $? ;;
      8) is_at_least "$v" "10.2.8-h3"; return $? ;;
      *) is_at_least "$v" "10.2.9-h1"; return $? ;;
    esac
  fi

  # PAN-OS 11.0 hotfix matrix from vendor advisory
  if [[ "$major.$minor" == "11.0" ]]; then
    case "$maint" in
      0) is_at_least "$v" "11.0.0-h3"; return $? ;;
      1) is_at_least "$v" "11.0.1-h4"; return $? ;;
      2) is_at_least "$v" "11.0.2-h4"; return $? ;;
      3) is_at_least "$v" "11.0.3-h10"; return $? ;;
      *) is_at_least "$v" "11.0.4-h1"; return $? ;;
    esac
  fi

  # PAN-OS 11.1 hotfix matrix from vendor advisory
  if [[ "$major.$minor" == "11.1" ]]; then
    case "$maint" in
      0) is_at_least "$v" "11.1.0-h3"; return $? ;;
      1) is_at_least "$v" "11.1.1-h1"; return $? ;;
      *) is_at_least "$v" "11.1.2-h3"; return $? ;;
    esac
  fi

  # Unaffected trains/products for this CVE
  if [[ "$major.$minor" == "9.0" || "$major.$minor" == "9.1" || "$major.$minor" == "10.0" || "$major.$minor" == "10.1" ]]; then
    return 0
  fi

  # Later major/minor trains not listed as affected in the vendor advisory
  if (( major > 11 )) || { (( major == 11 )) && (( minor > 1 )); }; then
    return 0
  fi

  # Could not classify
  return 2
}

SYSINFO_XML="$(fetch_api op cmd '<show><system><info></info></system></show>')"
if [[ -z "$SYSINFO_XML" ]] || ! echo "$SYSINFO_XML" | grep -q '<response status="success">'; then
  echo "UNKNOWN - failed to retrieve system info from API"
  exit 2
fi

SWVER="$(echo "$SYSINFO_XML" | tr -d '\n' | extract_tag sw-version)"
if [[ -z "$SWVER" ]]; then
  echo "UNKNOWN - could not parse sw-version"
  exit 2
fi

CFG_XML="$(fetch_api config xpath "/config/devices/entry[@name='localhost.localdomain']/network/global-protect")"
if [[ -z "$CFG_XML" ]] || ! echo "$CFG_XML" | grep -q '<response status="success">'; then
  echo "UNKNOWN - version=${SWVER}, failed to retrieve GlobalProtect config"
  exit 2
fi

HAS_GP=1
if echo "$CFG_XML" | grep -Eq '<global-protect>|<portal>|<gateways?>'; then
  HAS_GP=0
fi

is_patched_version "$SWVER"
PATCH_STATUS=$?

if [[ $PATCH_STATUS -eq 2 ]]; then
  echo "UNKNOWN - version=${SWVER}, could not classify against vendor matrix"
  exit 2
fi

if [[ $PATCH_STATUS -eq 0 ]]; then
  echo "PATCHED - version=${SWVER} is on an unaffected/fixed/hotfixed release"
  exit 0
fi

if [[ $HAS_GP -eq 0 ]]; then
  echo "VULNERABLE - version=${SWVER} is affected and GlobalProtect config appears present"
  exit 1
else
  echo "PATCHED - version=${SWVER} is affected in theory, but no GlobalProtect portal/gateway config was found"
  exit 0
fi