Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app

#!/usr/bin/env python3
# CVE-2026-0251 GlobalProtect version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import plistlib
import re
import subprocess
import sys
from pathlib import Path

APP_NAME = 'GlobalProtect'

class V:
    def __init__(self, major, minor, patch, hotfix=0):
        self.major = major
        self.minor = minor
        self.patch = patch
        self.hotfix = hotfix
    def key(self):
        return (self.major, self.minor, self.patch, self.hotfix)
    def __lt__(self, other):
        return self.key() < other.key()
    def __le__(self, other):
        return self.key() <= other.key()
    def __ge__(self, other):
        return self.key() >= other.key()
    def __gt__(self, other):
        return self.key() > other.key()
    def __repr__(self):
        return f'{self.major}.{self.minor}.{self.patch}-h{self.hotfix}' if self.hotfix else f'{self.major}.{self.minor}.{self.patch}'


def parse_version(text):
    if not text:
        return None
    # Accept versions like 6.3.3-h11, 6.3.3, 6.2.8-948, 6.3.3-c1016
    m = re.search(r'(\d+)\.(\d+)\.(\d+)(?:-h(\d+))?', text)
    if not m:
        return None
    major, minor, patch = int(m.group(1)), int(m.group(2)), int(m.group(3))
    hotfix = int(m.group(4)) if m.group(4) else 0
    return V(major, minor, patch, hotfix)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows_version():
    # Registry via PowerShell (most reliable without pywin32 dependency)
    ps = r'''
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$items = foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'GlobalProtect' } |
    Select-Object -First 1 DisplayName, DisplayVersion
}
$first = $items | Select-Object -First 1
if ($first) { $first.DisplayVersion }
'''
    out = run_cmd(['powershell', '-NoProfile', '-Command', ps])
    v = parse_version(out)
    if v:
        return v, out.strip()

    # Fallback: WMIC may still exist on some systems
    out = run_cmd(['wmic', 'product', 'where', "name like 'GlobalProtect%%'", 'get', 'version'])
    v = parse_version(out)
    if v:
        return v, out.strip()

    return None, ''


def detect_macos_version():
    candidates = [
        '/Applications/GlobalProtect.app/Contents/Info.plist',
        '/Library/PreferencePanes/GlobalProtect.prefPane/Contents/Info.plist'
    ]
    for p in candidates:
        try:
            if Path(p).exists():
                with open(p, 'rb') as f:
                    info = plistlib.load(f)
                text = str(info.get('CFBundleShortVersionString') or info.get('CFBundleVersion') or '')
                v = parse_version(text)
                if v:
                    return v, text
        except Exception:
            pass
    out = run_cmd(['defaults', 'read', '/Applications/GlobalProtect.app/Contents/Info', 'CFBundleShortVersionString'])
    v = parse_version(out)
    if v:
        return v, out.strip()
    return None, ''


def detect_linux_version():
    # App CLI
    for cmd in [
        ['globalprotect', 'version'],
        ['globalprotect', 'show', '--version'],
        ['/opt/paloaltonetworks/globalprotect/globalprotect', 'version']
    ]:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, out.strip()

    # Debian/Ubuntu package query
    out = run_cmd(['dpkg-query', '-W', '-f=${Package} ${Version}\n', 'globalprotect'])
    v = parse_version(out)
    if v:
        return v, out.strip()

    # RPM query
    for pkg in ['GlobalProtect', 'globalprotect']:
        out = run_cmd(['rpm', '-q', pkg])
        v = parse_version(out)
        if v:
            return v, out.strip()

    return None, ''


def in_range(v, start, end_exclusive):
    return v >= start and v < end_exclusive


def assess_windows_or_macos(v):
    # Advisory-covered vulnerable windows/macOS streams
    if in_range(v, V(6, 0, 0), V(6, 0, 13)):
        return 'VULNERABLE'
    if in_range(v, V(6, 2, 0), V(6, 2, 8, 10)):
        return 'VULNERABLE'
    if in_range(v, V(6, 3, 0), V(6, 3, 3, 11)):
        return 'VULNERABLE'

    # Known-not-listed stream: 6.1.x not present in vendor matrix
    if v.major == 6 and v.minor == 1:
        return 'UNKNOWN'

    # Newer branches or fixed branches treated as patched
    return 'PATCHED'


def assess_linux(v):
    if in_range(v, V(6, 0, 0), V(6, 0, 11)):
        return 'VULNERABLE'
    # Vendor says 6.2.0 through 6.2.9 are vulnerable
    if v.major == 6 and v.minor == 2 and v <= V(6, 2, 9, 999):
        return 'VULNERABLE'
    if in_range(v, V(6, 3, 0), V(6, 3, 3, 2)):
        return 'VULNERABLE'

    if v.major == 6 and v.minor == 1:
        return 'UNKNOWN'

    return 'PATCHED'


def main():
    sysname = platform.system().lower()
    version_obj = None
    raw = ''

    if 'windows' in sysname:
        version_obj, raw = detect_windows_version()
        platform_name = 'Windows'
    elif 'darwin' in sysname:
        version_obj, raw = detect_macos_version()
        platform_name = 'macOS'
    elif 'linux' in sysname:
        version_obj, raw = detect_linux_version()
        platform_name = 'Linux'
    else:
        print(f'UNKNOWN - unsupported platform: {platform.system()}')
        sys.exit(2)

    if not version_obj:
        print(f'UNKNOWN - {APP_NAME} version not detected on {platform_name}')
        sys.exit(2)

    if platform_name in ('Windows', 'macOS'):
        verdict = assess_windows_or_macos(version_obj)
    else:
        verdict = assess_linux(version_obj)

    print(f'{verdict} - platform={platform_name} detected_version={version_obj} raw="{raw}"')
    if verdict == 'PATCHED':
        sys.exit(0)
    elif verdict == 'VULNERABLE':
        sys.exit(1)
    else:
        sys.exit(2)


if __name__ == '__main__':
    main()