CVE-2021-3060: PAN-OS SCEP RCE Vulnerability

CVE-2021-3060 Overview

CVE-2021-3060 is a critical OS command injection vulnerability affecting Palo Alto Networks PAN-OS software's Simple Certificate Enrollment Protocol (SCEP) feature. This vulnerability allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue, making internet-facing deployments particularly at risk.

Critical Impact

Successful exploitation grants attackers root-level code execution on Palo Alto Networks firewalls, potentially compromising network perimeter security and enabling full infrastructure takeover.

Affected Products

• Palo Alto Networks PAN-OS 8.1 versions earlier than 8.1.20-h1
• Palo Alto Networks PAN-OS 9.0 versions earlier than 9.0.14-h3
• Palo Alto Networks PAN-OS 9.1 versions earlier than 9.1.11-h2
• Palo Alto Networks PAN-OS 10.0 versions earlier than 10.0.8
• Palo Alto Networks PAN-OS 10.1 versions earlier than 10.1.3
• Palo Alto Networks Prisma Access 2.1 Preferred
• Palo Alto Networks Prisma Access 2.1 Innovation

Discovery Timeline

• November 10, 2021 - CVE-2021-3060 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-3060

Vulnerability Analysis

This vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) exists within the Simple Certificate Enrollment Protocol (SCEP) implementation in PAN-OS. The SCEP feature is used for automated certificate enrollment and management, but improper input validation in this component allows attackers to inject malicious OS commands that are subsequently executed with root privileges.

The vulnerability requires the attacker to have specific knowledge of the firewall configuration and network access to GlobalProtect interfaces. While this prerequisite adds complexity to exploitation, organizations exposing GlobalProtect interfaces to the internet—a common deployment scenario—face significant risk. The ability to execute commands as root means attackers can fully compromise the firewall, intercept traffic, modify security policies, and pivot to internal network resources.

Root Cause

The root cause of CVE-2021-3060 is insufficient input sanitization within the SCEP feature's certificate enrollment handling logic. User-controlled input is passed directly to system shell commands without proper neutralization of special characters or command separators. This allows an attacker to break out of the intended command context and inject arbitrary OS commands that execute with the privileges of the PAN-OS process—root level access.

Attack Vector

The attack requires network access to the GlobalProtect portal or gateway interfaces. An unauthenticated attacker can craft malicious requests to the SCEP enrollment endpoint that include command injection payloads. When the vulnerable PAN-OS software processes these requests, the injected commands are executed with root privileges on the underlying operating system.

The exploitation scenario typically involves:

1. Identifying an exposed GlobalProtect interface with SCEP functionality enabled
2. Gaining knowledge of specific firewall configuration details
3. Crafting a malicious SCEP enrollment request containing OS command injection payloads
4. Sending the request to the vulnerable endpoint, triggering command execution

Due to the sensitive nature of this vulnerability and its potential for abuse, specific exploitation details are not provided. Organizations should refer to the Palo Alto Networks Security Advisory for technical details and patch information.

Detection Methods for CVE-2021-3060

Indicators of Compromise

• Unexpected processes spawning from PAN-OS system services with root privileges
• Anomalous outbound network connections from firewall management interfaces
• Unusual command execution patterns in system logs related to SCEP processing
• Unauthorized modifications to firewall configuration or security policies

Detection Strategies

• Monitor GlobalProtect interface logs for malformed or suspicious SCEP enrollment requests
• Implement network traffic analysis to detect unusual patterns targeting GlobalProtect endpoints
• Review system logs for unexpected shell command execution or process spawning
• Deploy intrusion detection signatures targeting command injection patterns in SCEP traffic

Monitoring Recommendations

• Enable verbose logging on GlobalProtect portal and gateway interfaces
• Implement real-time alerting for authentication failures and unusual access patterns to management interfaces
• Establish baseline behavior for SCEP-related processes and alert on deviations
• Monitor for unauthorized configuration changes or policy modifications on firewall devices

How to Mitigate CVE-2021-3060

Immediate Actions Required

• Update PAN-OS to the latest patched version immediately based on your deployment version
• Audit network exposure of GlobalProtect interfaces and restrict access where possible
• Review firewall configurations for any unauthorized changes that may indicate compromise
• Enable enhanced logging on GlobalProtect interfaces to aid in detection and forensic analysis

Patch Information

Palo Alto Networks has released patches addressing this vulnerability across all affected PAN-OS versions. Organizations should upgrade to the following minimum versions:

• PAN-OS 8.1: Upgrade to 8.1.20-h1 or later
• PAN-OS 9.0: Upgrade to 9.0.14-h3 or later
• PAN-OS 9.1: Upgrade to 9.1.11-h2 or later
• PAN-OS 10.0: Upgrade to 10.0.8 or later
• PAN-OS 10.1: Upgrade to 10.1.3 or later

For Prisma Access customers, Palo Alto Networks has deployed fixes to affected Prisma Access 2.1 Preferred and Innovation firewalls. Refer to the Palo Alto Networks Security Advisory for complete patch details and the Prisma Access Overview documentation for deployment guidance.

Workarounds

• Configure a unique master key for the firewall to reduce exploitability—refer to Palo Alto Networks Key Management documentation
• Restrict network access to GlobalProtect interfaces using firewall rules or network segmentation
• Disable SCEP functionality if not required for certificate enrollment operations
• Implement additional network security controls such as Web Application Firewalls in front of GlobalProtect interfaces

# Verify current PAN-OS version
show system info | match sw-version

# Check GlobalProtect configuration status
show global-protect-gateway current-gateway

# Review SCEP configuration
show config running | match scep