CyberCVE

CVE-2024-5908

GlobalProtect App: Encrypted Credential Exposure via Log Files

Severity
Medium 5.5
CVSS 4.0
Exploited
Not listed
EPSS
0.004
29.3th percentile
Discovered by
Third party
Published by the vendor
Published
Jun 12, 2024
Assigned by palo_alto

Description

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

Weakness: CWE-532

Affected products

Vendor Product Category Matched by
Palo Alto Networks GlobalProtect VPN & Remote Access cna-assigner
Vendor-reported affected versions (5)
  • Palo Alto Networks · GlobalProtect App
  • paloaltonetworks · globalprotect
  • paloaltonetworks · globalprotect
  • paloaltonetworks · globalprotect
  • paloaltonetworks · globalprotect

Credit

Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue.

Vendor remediation

This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions. Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.

References