CVE-2021-3062 - OpenCVE

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Paloaltonetworks	Pan-os Vm-series Firewall

Configuration 1 [-]

AND

OR	cpe:2.3:o:paloaltonetworks:pan-os::::::::
	cpe:2.3:o:paloaltonetworks:pan-os::::::::
	cpe:2.3:o:paloaltonetworks:pan-os::::::::
	cpe:2.3:o:paloaltonetworks:pan-os::::::::

cpe:2.3:a:paloaltonetworks:vm-series_firewall:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2021-3062

History

No history.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2021-11-10T17:10:27.900906Z

Updated: 2024-09-17T02:42:53.011Z

Reserved: 2021-01-06T00:00:00

Link: CVE-2021-3062

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-11-10T17:15:10.390

Modified: 2022-07-25T10:53:22.530

Link: CVE-2021-3062

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["VM-Series"], "product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "10.1.*"}, {"changes": [{"at": "9.1.11", "status": "unaffected"}], "lessThan": "9.1.11", "status": "affected", "version": "9.1", "versionType": "custom"}, {"changes": [{"at": "8.1.20", "status": "unaffected"}], "lessThan": "8.1.20", "status": "affected", "version": "8.1", "versionType": "custom"}, {"changes": [{"at": "9.0.14", "status": "unaffected"}], "lessThan": "9.0.14", "status": "affected", "version": "9.0", "versionType": "custom"}, {"changes": [{"at": "10.0.8", "status": "unaffected"}], "lessThan": "10.0.8", "status": "affected", "version": "10.0", "versionType": "custom"}]}, {"product": "Prisma Access", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "2.1 all"}, {"status": "unaffected", "version": "2.2 all"}]}], "configurations": [{"lang": "en", "value": "This issue is applicable only to PAN-OS firewall configurations with a GlobalProtect portal or gateway enabled. You can verify whether you have a GlobalProtect portal or gateway configured by checking for entries in 'Network > GlobalProtect > Portals' and in 'Network > GlobalProtect > Gateways' on the web interface."}], "credits": [{"lang": "en", "value": "Palo Alto Networks thanks Matthew Flanagan of Computer Systems Australia (CSA) for discovering and reporting this issue."}], "datePublic": "2021-11-10T00:00:00", "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue."}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-10T17:10:27", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.paloaltonetworks.com/CVE-2021-3062"}], "solutions": [{"lang": "en", "value": "This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.11, PAN-OS 10.0.8, and all later PAN-OS versions"}], "source": {"defect": ["PAN-164422"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2021-11-10T00:00:00", "value": "Initial publication"}], "title": "PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users", "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2021-11-10T17:00:00.000Z", "ID": "CVE-2021-3062", "STATE": "PUBLIC", "TITLE": "PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PAN-OS", "version": {"version_data": [{"platform": "VM-Series", "version_affected": "<", "version_name": "9.1", "version_value": "9.1.11"}, {"platform": "VM-Series", "version_affected": "<", "version_name": "8.1", "version_value": "8.1.20"}, {"platform": "VM-Series", "version_affected": "<", "version_name": "9.0", "version_value": "9.0.14"}, {"platform": "VM-Series", "version_affected": "!>=", "version_name": "9.1", "version_value": "9.1.11"}, {"platform": "VM-Series", "version_affected": "!>=", "version_name": "8.1", "version_value": "8.1.20"}, {"platform": "VM-Series", "version_affected": "!>=", "version_name": "9.0", "version_value": "9.0.14"}, {"platform": "VM-Series", "version_affected": "<", "version_name": "10.0", "version_value": "10.0.8"}, {"platform": "VM-Series", "version_affected": "!>=", "version_name": "10.0", "version_value": "10.0.8"}, {"platform": "VM-Series", "version_affected": "!", "version_name": "10.1", "version_value": "10.1.*"}]}}, {"product_name": "Prisma Access", "version": {"version_data": [{"version_affected": "!", "version_name": "2.1", "version_value": "all"}, {"version_affected": "!", "version_name": "2.2", "version_value": "all"}]}}]}, "vendor_name": "Palo Alto Networks"}]}}, "configuration": [{"lang": "en", "value": "This issue is applicable only to PAN-OS firewall configurations with a GlobalProtect portal or gateway enabled. You can verify whether you have a GlobalProtect portal or gateway configured by checking for entries in 'Network > GlobalProtect > Portals' and in 'Network > GlobalProtect > Gateways' on the web interface."}], "credit": [{"lang": "eng", "value": "Palo Alto Networks thanks Matthew Flanagan of Computer Systems Australia (CSA) for discovering and reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue."}]}, "exploit": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://security.paloaltonetworks.com/CVE-2021-3062", "refsource": "MISC", "url": "https://security.paloaltonetworks.com/CVE-2021-3062"}]}, "solution": [{"lang": "en", "value": "This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.11, PAN-OS 10.0.8, and all later PAN-OS versions"}], "source": {"defect": ["PAN-164422"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2021-11-10T00:00:00", "value": "Initial publication"}], "work_around": [{"lang": "en", "value": "There are no known workarounds for this issue."}], "x_advisoryEoL": false, "x_affectedList": ["PAN-OS 10.0.7", "PAN-OS 10.0.6", "PAN-OS 10.0.5", "PAN-OS 10.0.4", "PAN-OS 10.0.3", "PAN-OS 10.0.2", "PAN-OS 10.0.1", "PAN-OS 10.0.0", "PAN-OS 10.0", "PAN-OS 9.1.10", "PAN-OS 9.1.9", "PAN-OS 9.1.8", "PAN-OS 9.1.7", "PAN-OS 9.1.6", "PAN-OS 9.1.5", "PAN-OS 9.1.4", "PAN-OS 9.1.3-h1", "PAN-OS 9.1.3", "PAN-OS 9.1.2-h1", "PAN-OS 9.1.2", "PAN-OS 9.1.1", "PAN-OS 9.1.0-h3", "PAN-OS 9.1.0-h2", "PAN-OS 9.1.0-h1", "PAN-OS 9.1.0", "PAN-OS 9.1", "PAN-OS 9.0.13", "PAN-OS 9.0.12", "PAN-OS 9.0.11", "PAN-OS 9.0.10", "PAN-OS 9.0.9-h1", "PAN-OS 9.0.9", "PAN-OS 9.0.8", "PAN-OS 9.0.7", "PAN-OS 9.0.6", "PAN-OS 9.0.5", "PAN-OS 9.0.4", "PAN-OS 9.0.3-h3", "PAN-OS 9.0.3-h2", "PAN-OS 9.0.3-h1", "PAN-OS 9.0.3", "PAN-OS 9.0.2-h4", "PAN-OS 9.0.2-h3", "PAN-OS 9.0.2-h2", "PAN-OS 9.0.2-h1", "PAN-OS 9.0.2", "PAN-OS 9.0.1", "PAN-OS 9.0.0", "PAN-OS 9.0", "PAN-OS 8.1.19", "PAN-OS 8.1.18", "PAN-OS 8.1.17", "PAN-OS 8.1.16", "PAN-OS 8.1.15-h3", "PAN-OS 8.1.15-h2", "PAN-OS 8.1.15-h1", "PAN-OS 8.1.15", "PAN-OS 8.1.14-h2", "PAN-OS 8.1.14-h1", "PAN-OS 8.1.14", "PAN-OS 8.1.13", "PAN-OS 8.1.12", "PAN-OS 8.1.11", "PAN-OS 8.1.10", "PAN-OS 8.1.9-h4", "PAN-OS 8.1.9-h3", "PAN-OS 8.1.9-h2", "PAN-OS 8.1.9-h1", "PAN-OS 8.1.9", "PAN-OS 8.1.8-h5", "PAN-OS 8.1.8-h4", "PAN-OS 8.1.8-h3", "PAN-OS 8.1.8-h2", "PAN-OS 8.1.8-h1", "PAN-OS 8.1.8", "PAN-OS 8.1.7", "PAN-OS 8.1.6-h2", "PAN-OS 8.1.6-h1", "PAN-OS 8.1.6", "PAN-OS 8.1.5", "PAN-OS 8.1.4", "PAN-OS 8.1.3", "PAN-OS 8.1.2", "PAN-OS 8.1.1", "PAN-OS 8.1.0", "PAN-OS 8.1"], "x_likelyAffectedList": ["PAN-OS 8.0.20", "PAN-OS 8.0.19-h1", "PAN-OS 8.0.19", "PAN-OS 8.0.18", "PAN-OS 8.0.17", "PAN-OS 8.0.16", "PAN-OS 8.0.15", "PAN-OS 8.0.14", "PAN-OS 8.0.13", "PAN-OS 8.0.12", "PAN-OS 8.0.11-h1", "PAN-OS 8.0.10", "PAN-OS 8.0.9", "PAN-OS 8.0.8", "PAN-OS 8.0.7", "PAN-OS 8.0.6-h3", "PAN-OS 8.0.6-h2", "PAN-OS 8.0.6-h1", "PAN-OS 8.0.6", "PAN-OS 8.0.5", "PAN-OS 8.0.4", "PAN-OS 8.0.3-h4", "PAN-OS 8.0.3-h3", "PAN-OS 8.0.3-h2", "PAN-OS 8.0.3-h1", "PAN-OS 8.0.3", "PAN-OS 8.0.2", "PAN-OS 8.0.1", "PAN-OS 8.0.0", "PAN-OS 8.0", "PAN-OS 7.1.26", "PAN-OS 7.1.25", "PAN-OS 7.1.24-h1", "PAN-OS 7.1.24", "PAN-OS 7.1.23", "PAN-OS 7.1.22", "PAN-OS 7.1.21", "PAN-OS 7.1.20", "PAN-OS 7.1.19", "PAN-OS 7.1.18", "PAN-OS 7.1.17", "PAN-OS 7.1.16", "PAN-OS 7.1.15", "PAN-OS 7.1.14", "PAN-OS 7.1.13", "PAN-OS 7.1.12", "PAN-OS 7.1.11", "PAN-OS 7.1.10", "PAN-OS 7.1.9-h4", "PAN-OS 7.1.9-h3", "PAN-OS 7.1.9-h2", "PAN-OS 7.1.9-h1", "PAN-OS 7.1.9", "PAN-OS 7.1.8", "PAN-OS 7.1.7", "PAN-OS 7.1.6", "PAN-OS 7.1.5", "PAN-OS 7.1.4-h2", "PAN-OS 7.1.4-h1", "PAN-OS 7.1.4", "PAN-OS 7.1.3", "PAN-OS 7.1.2", "PAN-OS 7.1.1", "PAN-OS 7.1.0", "PAN-OS 7.1"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T16:45:51.083Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.paloaltonetworks.com/CVE-2021-3062"}]}]}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2021-3062", "datePublished": "2021-11-10T17:10:27.900906Z", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2024-09-17T02:42:53.011Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "97BB12BB-096E-4CCD-B5F4-55900801DF74", "versionEndExcluding": "8.1.20", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9EE274A-3AF1-4204-B43D-1EA54C6442CC", "versionEndExcluding": "9.0.14", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "3725416F-6A77-40E2-91F3-3EDB9D6C9AC2", "versionEndExcluding": "9.1.11", "versionStartIncluding": "9.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "C408A950-281A-49DC-9376-F1D943280371", "versionEndExcluding": "10.0.8", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:vm-series_firewall:-:*:*:*:*:*:*:*", "matchCriteriaId": "162CEA5E-55E6-480B-B4AA-B9B085B7D615", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inapropiada en el software PAN-OS permite a un atacante con acceso autenticado a los portales y puertas de enlace de GlobalProtect conectarse al endpoint de metadatos de la instancia EC2 para los firewalls VM-Series alojados en Amazon AWS. Una explotaci\u00f3n de esta vulnerabilidad permite a un atacante llevar a cabo cualquier operaci\u00f3n permitida por el rol EC2 en AWS. Este problema afecta a: PAN-OS versiones 8.1 anteriores a los firewalls VM-Series de PAN-OS 8.1.20; PAN-OS versiones 9.1 anteriores a los firewalls VM-Series de PAN-OS 9.1.11; PAN-OS versiones 9.0 anteriores a los firewalls VM-Series de PAN-OS 9.0.14; PAN-OS versiones 10.0 anteriores a los firewalls VM-Series de PAN-OS 10.0.8. Los clientes de Prisma Access no est\u00e1n afectados por este problema"}], "id": "CVE-2021-3062", "lastModified": "2022-07-25T10:53:22.530", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}, "published": "2021-11-10T17:15:10.390", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2021-3062"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}