CVE DatabaseCVE-2024-9465

Updated 2026-06-17한국어 권고문 →

CVE-2024-94659.1/CRITICALCISA KEVCWE-89CWE-89

Palo Alto Networks Expedition SQL Injection and Arbitrary File Creation Vulnerability (CVE-2024-9465) Security Advisory

⚡ Jump to Patch

Affected Vendors

palo alto networks

Affected Components

expedition

Published Date

2024-10-09

CVSS v3.1

9.1

CRITICAL

EPSS (30d)

99.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All vulnerable versions of Palo Alto Networks Expedition migration tool

Impact

Unauthenticated remote attackers can extract database contents (password hashes, API keys) and read/write arbitrary files, leading to full system compromise

Mitigation

Immediately upgrade Expedition to the latest patched version and restrict network access to trusted administrative hosts

Affected Products & Version Scope

Palo Alto Networks Expedition, all versions prior to the patched releases addressed in PAN-SA-2024-0010

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Access the Expedition server via SSH and run the following commands to update the package repositories and upgrade the software to the latest secure version.

bash

# Update package lists and upgrade the Expedition package
sudo apt-get update
sudo apt-get --only-upgrade install expedition -y

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the Expedition web interface (ports 80 and 443) using firewall rules to ensure it is only accessible from trusted administrator IPs.

bash

# Restrict HTTP/HTTPS access to a specific trusted admin IP (e.g., 192.168.1.100) using UFW
sudo ufw default deny incoming
sudo ufw allow from 192.168.1.100 to any port 80 proto tcp
sudo ufw allow from 192.168.1.100 to any port 443 proto tcp
sudo ufw enable

3. Log Audit & IoC Verification Commands

Inspect the Apache web server access logs for potential SQL injection patterns and unauthorized database interaction attempts.

bash

# Search Apache access logs for common SQL injection indicators
sudo grep -Ei 'union|select|char|concat|schema' /var/log/apache2/access.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately apply the official security updates or restrict network exposure.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-9465) is a critical SQL injection flaw in Palo Alto Networks Expedition, a migration tool used for firewall configurations. The root cause lies in the failure of the application to properly sanitize and parameterize user-supplied inputs before passing them to database queries (CWE-89).

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP requests containing malicious SQL payloads to the Expedition web interface. Successful exploitation allows the attacker to bypass authentication, retrieve sensitive database contents (including usernames, password hashes, device configurations, and API keys), and leverage database file-system privileges to read or write arbitrary files on the underlying operating system.

3. Infrastructure & Business Impact

Because Expedition handles highly sensitive firewall configuration data and API keys, a compromise of this system can expose the entire network security architecture. This vulnerability is actively exploited in the wild (listed in CISA KEV) and carries an extremely high EPSS score of 0.9963, posing an immediate threat to enterprise infrastructure.

Official Vendor Advisories & References

NVD Original English Description

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

https://security.paloaltonetworks.com/PAN-SA-2024-0010

Source: psirt@paloaltonetworks.com · Mitigation, Vendor Advisory

https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/

Source: psirt@paloaltonetworks.com · Exploit

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9465

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2024-9465)

FAQ

Q1. How critical is CVE-2024-9465 and is it actively exploited in the wild?

CVE-2024-9465 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 99.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-9465?

Primary impacted vendors include palo alto networks across expedition. Scope summary: Palo Alto Networks Expedition, all versions prior to the patched releases addressed in PAN-SA-2024-0010

Q3. What temporary mitigations or workarounds exist for CVE-2024-9465 before patching?

[Mitigation] Immediately upgrade Expedition to the latest patched version and restrict network access to trusted administrative hosts Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION