CVE-2021-3055 : What You Need to Know
Learn about CVE-2021-3055, an XXE vulnerability in Palo Alto Networks PAN-OS web interface that leads to denial of service. Find out impacted versions and mitigation steps.
An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.20, PAN-OS 9.0 versions earlier than PAN-OS 9.0.14, PAN-OS 9.1 versions earlier than PAN-OS 9.1.10, and PAN-OS 10.0 versions earlier than PAN-OS 10.0.6.
Understanding CVE-2021-3055
This CVE details an XXE vulnerability in the PAN-OS web interface that allows an authenticated attacker to read files from the system and crash services.
What is CVE-2021-3055?
The vulnerability in Palo Alto Networks PAN-OS web interface allows an authenticated admin to read arbitrary files and crash services.
The Impact of CVE-2021-3055
The impact includes denial of service to all PAN-OS services by forcing the device into maintenance mode.
Technical Details of CVE-2021-3055
This vulnerability affects PAN-OS versions earlier than 8.1.20, 9.0.14, 9.1.10, and 10.0.6.
Vulnerability Description
The XXE vulnerability allows an attacker to read any file from the system, potentially leading to a denial of service.
Affected Systems and Versions
PAN-OS 8.1 versions less than 8.1.20, PAN-OS 9.0 versions less than 9.0.14, PAN-OS 9.1 versions less than 9.1.10, and PAN-OS 10.0 versions less than 10.0.6 are affected.
Exploitation Mechanism
An authenticated attacker can send crafted requests to the firewall, leading to service crashes and denial of service.
Mitigation and Prevention
Immediate actions and best practices can help mitigate the risks associated with CVE-2021-3055.
Immediate Steps to Take
Ensure authenticated access to the web interface is secure and follow recommended best practices.
Long-Term Security Practices
Regularly monitor and update PAN-OS versions to stay protected from known vulnerabilities.
Patching and Updates
Update to fixed versions: PAN-OS 8.1.20, 9.0.14, 9.1.10, 10.0.6, or later.