Description
A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App | 5.1, 6.0, 6.1, 6.2.0 – < 6.2.5, 6.3 | 6.2.5 |
Advisories 1
- WID-SEC-2024-3118 PaloAlto Networks GlobalProtect: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Oct 8, 2024
References
- https://security.paloaltonetworks.com/CVE-2024-9473 vendor-advisory
- https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-palo-alto-networks-globalprotect/ third-party-advisory exploit