Palo Alto Networks has released indicators of compromise (IoCs) for the attacks exploiting a newly uncovered firewall zero-day vulnerability.
The company recently came across claims regarding a previously unknown remote code execution vulnerability in its PAN-OS operating system.
A security advisory published by the company on November 8 urged customers to ensure that access to the PAN-OS management interface is secured, but said there had been no indication of a zero-day being exploited in attacks.
However, the advisory was updated on November 15 to inform customers that the cybersecurity giant had started seeing exploitation of a critical unauthenticated remote code execution vulnerability against a limited number of firewalls that had the PAN-OS interface exposed to the internet.
The company once again updated the advisory over the weekend to share some IoCs, including three IP addresses from which threat activity originated, and the checksum associated with a webshell observed in attacks.
Palo Alto saw threat activity coming from the three IP addresses, but noted that “these IP addresses may represent third party VPNs with legitimate user activity originating from these IPs to other destinations”.
The company has yet to assign a CVE identifier to the new zero-day and patches have yet to be released, but ensuring that the PAN-OS management interface is not exposed to the internet significantly mitigates the risk of exploitation.
“We strongly recommend customers ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines. In particular, we recommend that you immediately ensure that access to the management interface is possible only from trusted internal IPs and not from the Internet,” Palo Alto said. “The vast majority of firewalls already follow this Palo Alto Networks and industry best practice.”
While it’s unclear who has exploited the vulnerability and who the victims are, Risky Biz reported that Palo Alto Networks may have learned about the zero-day’s existence from a post on a cybercrime forum that offered to sell a PAN-OS zero-day allowing remote code execution.
The cybersecurity agency CISA recently warned organizations about three Palo Alto Networks Expedition flaws being exploited in the wild. All of the Expedition vulnerabilities were patched weeks or months before news of their exploitation broke.
Related: Thousands of Palo Alto Firewalls Potentially Impacted by Exploited Vulnerability
Related: State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls
Related: Palo Alto Networks Patches Unauthenticated Command Execution Flaw in Cortex XSOAR
