Palo Alto Networks Expedition RCE Chain: CVE-2024-9463 & CVE-2024-5910 Expose Enterprise Firewall Secrets

Palo Alto Networks issued an urgent security advisory (PAN-SA-2024-0010) warning organizations of active exploitation targeting Expedition, the official migration and configuration tool used by network engineers to translate configurations from Check Point, Cisco ASA, Fortinet, and Juniper firewalls into PAN-OS and Panorama. Threat actors are weaponizing an exploit chain combining CVE-2024-5910 (an authentication bypass permitting administrative account takeover) and CVE-2024-9463 (a CVSS 9.9 unauthenticated OS command injection flaw) to gain root-level code execution on Expedition servers and systematically harvest enterprise perimeter firewall credentials.

The Critical Threat: Why Expedition is a Goldmine for Attackers

Expedition is designed to ingest massive, comprehensive configuration files from across an organization’s perimeter infrastructure. When engineers use Expedition to migrate firewall rules, the software decrypts and stores:

• Cleartext administrative usernames and password hashes.
• PAN-OS and Panorama API keys granting full administrative control over live perimeter firewalls.
• IPSec VPN pre-shared keys (PSKs), private certificates, and BGP routing configurations.
• Internal network topology diagrams and address group schemas.

If an attacker gains command execution on an Expedition server, they do not merely compromise a single host—they obtain the master keys to the entire corporate network perimeter.

Vulnerability Mechanics & Decompiled Exploit Chain

The primary vulnerability, CVE-2024-9463, exists within internal PHP API endpoints that accept user input without sanitization before passing it directly to system execution functions like exec(), system(), or passthru():

<?php
/* Vulnerable endpoint in Expedition API controller */
if (isset($_GET['action']) && $_GET['action'] == 'test_connection') {
    $target_host = $_POST['host']; // UNSANITIZED INPUT
    $port = $_POST['port'];
    
    // VULNERABILITY: Direct concatenation into shell command string
    $cmd = "nc -z -w 3 " . $target_host . " " . escapeshellarg($port);
    $output = shell_exec($cmd);
    
    echo json_encode(["status" => "success", "result" => $output]);
}
?>

Because the parameter host is concatenated directly into the shell string without sanitization, an attacker can append command delimiters (such as ;, |, or $()) to execute arbitrary Linux commands with the privileges of the web service. When chained with CVE-2024-5910 (which allows attackers to reset the administrator password due to missing authentication in the reset handler), adversaries achieve complete, persistent root control over the appliance.

Attacker Playbook: Extracting PAN-OS API Keys

Once root shell access is achieved, attackers execute automated discovery scripts to dump Expedition’s internal MySQL/MariaDB database and extract active Panorama API keys:

# Attacker payload extracting PAN-OS credentials from Expedition database
mysql -u root -p$(grep password /etc/mysql/debian.cnf | head -1 | awk '{print $3}')   -e "SELECT device_name, ip_address, username, api_key FROM expedition.devices;"

Using the harvested api_key, the attacker pivots directly to live production firewalls via the XML API to disable security profiles, add backdoor administrative accounts, or create permissive security rules allowing unrestricted command and control traffic.

Detection Telemetry & Threat Hunting

Remediation & Incident Response Protocol

1. Immediate Upgrade: Upgrade Palo Alto Networks Expedition to version 1.2.92 or later immediately.
2. Isolate or Decommission: Expedition is intended solely as an offline migration utility. Disconnect Expedition from the network when not actively in use, and strictly prohibit any direct internet exposure.
3. MANDATORY Credential Rotation: If an Expedition instance was network-accessible or unpatched, assume all configuration files stored inside are compromised. Rotate all PAN-OS/Panorama API keys, firewall admin passwords, and VPN PSKs handled by the appliance.