CVE-2022-0016 - Vulnerability Details - OpenCVE

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00123.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Macos
Microsoft	Windows
Paloaltonetworks	Globalprotect

Configuration 1 [-]

AND

cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

No data.

Fixes

Solution

This issue is fixed in GlobalProtect app 5.2.9 on Windows and MacOS, and all later GlobalProtect app versions.

Workaround

There are no known workarounds for this issue.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2022-0016

History

No history.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2022-02-10T18:10:16.879284Z

Updated: 2024-09-17T02:00:45.459Z

Reserved: 2021-12-28T00:00:00

Link: CVE-2022-0016

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-02-10T18:15:08.503

Modified: 2024-11-21T06:37:49.420

Link: CVE-2022-0016

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"platforms": ["Windows and MacOS"], "product": "GlobalProtect App", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "5.2.9", "status": "unaffected"}], "lessThan": "5.2.9", "status": "affected", "version": "5.2", "versionType": "custom"}]}, {"product": "GlobalProtect App", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "5.3.*"}, {"lessThan": "5.1*", "status": "unaffected", "version": "5.1.*", "versionType": "custom"}]}], "configurations": [{"lang": "en", "value": "This issue is applicable only to devices configured to use the GlobalProtect Connect Before Logon feature."}], "credits": [{"lang": "en", "value": "Palo Alto Networks thanks Adam Crosser (Praetorian), Brian Sizemore (Praetorian) and N. Sao (Genetec) for independently discovering and reporting this issue."}], "datePublic": "2022-02-09T00:00:00", "descriptions": [{"lang": "en", "value": "An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms."}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-703", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-10T18:10:16", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.paloaltonetworks.com/CVE-2022-0016"}], "solutions": [{"lang": "en", "value": "This issue is fixed in GlobalProtect app 5.2.9 on Windows and MacOS, and all later GlobalProtect app versions."}], "source": {"defect": ["GPC-14404", "GPC-13685", "GPC-14747"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2022-02-09T00:00:00", "value": "Initial publication"}], "title": "GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon", "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2022-02-09T17:00:00.000Z", "ID": "CVE-2022-0016", "STATE": "PUBLIC", "TITLE": "GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GlobalProtect App", "version": {"version_data": [{"platform": "Windows and MacOS", "version_affected": "<", "version_name": "5.2", "version_value": "5.2.9"}, {"platform": "Windows and MacOS", "version_affected": "!>=", "version_name": "5.2", "version_value": "5.2.9"}, {"version_affected": "!>=", "version_name": "5.1", "version_value": "5.1.*"}, {"version_affected": "!", "version_name": "5.3", "version_value": "5.3.*"}]}}]}, "vendor_name": "Palo Alto Networks"}]}}, "configuration": [{"lang": "en", "value": "This issue is applicable only to devices configured to use the GlobalProtect Connect Before Logon feature."}], "credit": [{"lang": "eng", "value": "Palo Alto Networks thanks Adam Crosser (Praetorian), Brian Sizemore (Praetorian) and N. Sao (Genetec) for independently discovering and reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms."}]}, "exploit": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}]}, "references": {"reference_data": [{"name": "https://security.paloaltonetworks.com/CVE-2022-0016", "refsource": "MISC", "url": "https://security.paloaltonetworks.com/CVE-2022-0016"}]}, "solution": [{"lang": "en", "value": "This issue is fixed in GlobalProtect app 5.2.9 on Windows and MacOS, and all later GlobalProtect app versions."}], "source": {"defect": ["GPC-14404", "GPC-13685", "GPC-14747"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2022-02-09T00:00:00", "value": "Initial publication"}], "work_around": [{"lang": "en", "value": "There are no known workarounds for this issue."}], "x_advisoryEoL": true, "x_affectedList": ["GlobalProtect App 5.2.8", "GlobalProtect App 5.2.7", "GlobalProtect App 5.2.6", "GlobalProtect App 5.2.5", "GlobalProtect App 5.2.4", "GlobalProtect App 5.2.3", "GlobalProtect App 5.2.2", "GlobalProtect App 5.2.1", "GlobalProtect App 5.2.0", "GlobalProtect App 5.2"], "x_likelyAffectedList": ["GlobalProtect App 5.0.10", "GlobalProtect App 5.0.9", "GlobalProtect App 5.0.8", "GlobalProtect App 5.0.7", "GlobalProtect App 5.0.6", "GlobalProtect App 5.0.5", "GlobalProtect App 5.0.4", "GlobalProtect App 5.0.3", "GlobalProtect App 5.0.2", "GlobalProtect App 5.0.1", "GlobalProtect App 5.0.0", "GlobalProtect App 5.0", "GlobalProtect App 4.1.13", "GlobalProtect App 4.1.12", "GlobalProtect App 4.1.11", "GlobalProtect App 4.1.10", "GlobalProtect App 4.1.9", "GlobalProtect App 4.1.8", "GlobalProtect App 4.1.7", "GlobalProtect App 4.1.6", "GlobalProtect App 4.1.5", "GlobalProtect App 4.1.4", "GlobalProtect App 4.1.3", "GlobalProtect App 4.1.2", "GlobalProtect App 4.1.1", "GlobalProtect App 4.1.0", "GlobalProtect App 4.1", "GlobalProtect App 4.0.8", "GlobalProtect App 4.0.7", "GlobalProtect App 4.0.6", "GlobalProtect App 4.0.5", "GlobalProtect App 4.0.4", "GlobalProtect App 4.0.3", "GlobalProtect App 4.0.2", "GlobalProtect App 4.0.0", "GlobalProtect App 4.0", "GlobalProtect App 3.1.6", "GlobalProtect App 3.1.5", "GlobalProtect App 3.1.4", "GlobalProtect App 3.1.3", "GlobalProtect App 3.1.1", "GlobalProtect App 3.1.0", "GlobalProtect App 3.1", "GlobalProtect App 3.0.3", "GlobalProtect App 3.0.2", "GlobalProtect App 3.0.1", "GlobalProtect App 3.0.0", "GlobalProtect App 3.0", "GlobalProtect App 2.3.5", "GlobalProtect App 2.3.4", "GlobalProtect App 2.3.3", "GlobalProtect App 2.3.2", "GlobalProtect App 2.3.1", "GlobalProtect App 2.3.0", "GlobalProtect App 2.3", "GlobalProtect App 2.2.2", "GlobalProtect App 2.2.1", "GlobalProtect App 2.2.0", "GlobalProtect App 2.2", "GlobalProtect App 2.1.4", "GlobalProtect App 2.1.3", "GlobalProtect App 2.1.2", "GlobalProtect App 2.1.1", "GlobalProtect App 2.1.0", "GlobalProtect App 2.1", "GlobalProtect App 2.0.5", "GlobalProtect App 2.0.4", "GlobalProtect App 2.0.3", "GlobalProtect App 2.0.2", "GlobalProtect App 2.0.1", "GlobalProtect App 2.0.0", "GlobalProtect App 2.0", "GlobalProtect App 1.2.11", "GlobalProtect App 1.2.10", "GlobalProtect App 1.2.9", "GlobalProtect App 1.2.8", "GlobalProtect App 1.2.7", "GlobalProtect App 1.2.6", "GlobalProtect App 1.2.5", "GlobalProtect App 1.2.4", "GlobalProtect App 1.2.3", "GlobalProtect App 1.2.2", "GlobalProtect App 1.2.1", "GlobalProtect App 1.2.0", "GlobalProtect App 1.2", "GlobalProtect App 1.1.8", "GlobalProtect App 1.1.7", "GlobalProtect App 1.1.6", "GlobalProtect App 1.1.5", "GlobalProtect App 1.1.4", "GlobalProtect App 1.1.3", "GlobalProtect App 1.1.2", "GlobalProtect App 1.1.1", "GlobalProtect App 1.1.0", "GlobalProtect App 1.1", "GlobalProtect App 1.0.8", "GlobalProtect App 1.0.7", "GlobalProtect App 1.0.5", "GlobalProtect App 1.0.3", "GlobalProtect App 1.0.1", "GlobalProtect App 1.0"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:18:41.378Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.paloaltonetworks.com/CVE-2022-0016"}]}]}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2022-0016", "datePublished": "2022-02-10T18:10:16.879284Z", "dateReserved": "2021-12-28T00:00:00", "dateUpdated": "2024-09-17T02:00:45.459Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*", "matchCriteriaId": "84B6241D-4456-4DC4-9767-3E608BCA0972", "versionEndExcluding": "5.2.9", "versionStartIncluding": "5.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de manejo inapropiado de condiciones excepcionales en la funcionalidad Connect Before Logon de GlobalProtect app de Palo Alto Networks que permite a un atacante local escalar a privilegios SYSTEM o root cuando es autenticado con Connect Before Logon en determinadas circunstancias. Este problema afecta a GlobalProtect app versiones 5.2 anteriores a 5.2.9 en Windows y MacOS. Este problema no afecta a GlobalProtect app en otras plataformas"}], "id": "CVE-2022-0016", "lastModified": "2024-11-21T06:37:49.420", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 5.9, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-10T18:15:08.503", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2022-0016"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2022-0016"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-703"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}]}