CISA WARNS OF CRITICAL PALO ALTO NETWORKS BUG EXPLOITED IN ATTACKS

Summary from the TLDR InfoSec newsletter

The CISA warned that attackers are actively exploiting a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool for migrating firewall configurations from other vendors to PanOS. The vulnerability allows attackers with network access to takeover Expedition admin accounts and potentially access configuration secrets, credentials, and other data. All Expedition usernames, passwords, API keys, and any firewalls processed by Expedition should be rotated after upgrading. Various proof-of-concept attack chains that exploit the vulnerability to obtain admin access to Palo Alto Networks firewalls are available in the article.