CVE-2021-3056 Explained : Impact and Mitigation

A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This vulnerability impacts various versions of PAN-OS and Prisma Access firewalls.

Understanding CVE-2021-3056

This section provides an overview of the critical vulnerability in Palo Alto Networks PAN-OS and Prisma Access.

What is CVE-2021-3056?

CVE-2021-3056 is a memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN that allows an authenticated attacker to run arbitrary code with root user privileges during SAML authentication.

The Impact of CVE-2021-3056

The vulnerability has a high severity impact, affecting confidentiality, integrity, and availability of the affected systems. The CVSS base score for this vulnerability is 8.8 (High).

Technical Details of CVE-2021-3056

This section delves into specific technical details related to the vulnerability.

Vulnerability Description

The vulnerability arises in PAN-OS GlobalProtect Clientless VPN, enabling unauthorized code execution during SAML authentication.

Affected Systems and Versions

PAN-OS versions earlier than 8.1.20, 9.0.14, 9.1.9, and 10.0.1 are affected. Prisma Access 2.1 Preferred firewalls are also impacted by this vulnerability.

Exploitation Mechanism

Palo Alto Networks identified that no malicious exploitation of this vulnerability has been reported.

Mitigation and Prevention

Steps to prevent exploitation and mitigate the risks associated with CVE-2021-3056 are outlined in this section.

Immediate Steps to Take

Palo Alto Networks recommends enabling signatures for Unique Threat ID 91585 on firewall traffic to block potential attacks.

Long-Term Security Practices

Regularly updating to fixed versions of PAN-OS and Prisma Access is crucial for continued protection against this vulnerability.

Patching and Updates

The issue is resolved in PAN-OS 8.1.20, 9.0.14, 9.1.9, 10.0.1, and later versions. Prisma Access customers are advised to update to 2.2 Preferred or newer.