CVE-2021-3062: PAN-OS Auth Bypass Vulnerability

CVE-2021-3062 Overview

CVE-2021-3062 is an improper access control vulnerability in Palo Alto Networks PAN-OS software that affects VM-Series firewalls deployed on Amazon AWS. The vulnerability enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint. Successful exploitation allows an attacker to perform any operations permitted by the EC2 role assigned to the VM-Series instance in AWS, potentially leading to significant cloud infrastructure compromise.

Critical Impact
Authenticated attackers can access EC2 instance metadata, enabling them to retrieve IAM credentials and perform unauthorized operations within the AWS environment using the permissions granted to the compromised VM-Series firewall's EC2 role.

Affected Products

PAN-OS 8.1 versions earlier than 8.1.20 (VM-Series firewalls)
PAN-OS 9.0 versions earlier than 9.0.14 (VM-Series firewalls)
PAN-OS 9.1 versions earlier than 9.1.11 (VM-Series firewalls)
PAN-OS 10.0 versions earlier than 10.0.8 (VM-Series firewalls)
Palo Alto Networks VM-Series Firewall on AWS

Discovery Timeline

November 10, 2021 - CVE-2021-3062 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-3062

Vulnerability Analysis

This vulnerability stems from improper access control within the GlobalProtect portal and gateway components of PAN-OS. When VM-Series firewalls are deployed on AWS infrastructure, they have access to the EC2 instance metadata service (IMDS) at the link-local address 169.254.169.254. Under normal circumstances, access to this endpoint should be restricted to authorized system processes only.

The flaw allows authenticated users with access to GlobalProtect to proxy requests through the firewall to reach the EC2 metadata endpoint. This is particularly dangerous because the EC2 metadata service exposes sensitive information including temporary IAM credentials associated with the instance's IAM role. These credentials can then be used to perform actions within the AWS environment based on the permissions granted to the role.

Importantly, Prisma Access customers are not impacted by this vulnerability, as their deployment architecture differs from the self-managed VM-Series on AWS.

Root Cause

The root cause is classified under CWE-284 (Improper Access Control). The GlobalProtect component fails to properly validate and restrict outbound connections initiated through authenticated sessions. Specifically, the software does not prevent authenticated users from leveraging their session to access the internal EC2 instance metadata endpoint, which should be accessible only to the firewall's own operating system processes.

Attack Vector

The attack requires network access and authenticated credentials to a GlobalProtect portal or gateway running on an affected VM-Series firewall in AWS. The attacker must first authenticate to GlobalProtect using valid credentials, then craft requests that traverse through the firewall to reach the EC2 metadata service. Once the attacker retrieves the IAM role credentials from the metadata endpoint, they can use these credentials externally to perform AWS API calls with whatever permissions the VM-Series instance's IAM role possesses.

The vulnerability is exploitable over the network and requires low complexity to execute once authentication is achieved. No user interaction is required beyond the initial authenticated session establishment.

Detection Methods for CVE-2021-3062

Indicators of Compromise

Unusual outbound connections from GlobalProtect sessions to the EC2 metadata endpoint (169.254.169.254)
Unexpected API calls to AWS services using the VM-Series instance's IAM role credentials from external IP addresses
Authentication logs showing legitimate users followed by suspicious metadata service access patterns
CloudTrail logs revealing IAM credential usage from unexpected source locations

Detection Strategies

Monitor GlobalProtect session logs for requests targeting internal AWS metadata endpoints
Implement AWS CloudTrail monitoring for API calls made using the VM-Series instance credentials from unexpected source IPs
Configure AWS GuardDuty to detect anomalous credential usage patterns
Deploy SentinelOne Singularity Cloud Security to identify suspicious access patterns in AWS environments

Monitoring Recommendations

Enable detailed logging on GlobalProtect portals and gateways to capture all user session activity
Configure alerting for any access attempts to the 169.254.169.254 address from authenticated user sessions
Implement AWS IAM Access Analyzer to continuously monitor for unusual credential activity
Establish baseline behavior for your VM-Series instances and alert on deviations

How to Mitigate CVE-2021-3062

Immediate Actions Required

Upgrade affected VM-Series firewalls to the patched PAN-OS versions immediately (8.1.20, 9.0.14, 9.1.11, or 10.0.8 or later)
Audit AWS IAM roles assigned to VM-Series instances and apply the principle of least privilege
Review GlobalProtect user access and credentials for any unauthorized activity
Enable AWS IMDSv2 on VM-Series instances to add an additional layer of protection

Patch Information

Palo Alto Networks has released security patches addressing this vulnerability. Affected organizations should upgrade to the following minimum versions:

PAN-OS 8.1: Upgrade to version 8.1.20 or later
PAN-OS 9.0: Upgrade to version 9.0.14 or later
PAN-OS 9.1: Upgrade to version 9.1.11 or later
PAN-OS 10.0: Upgrade to version 10.0.8 or later

For detailed patch information, refer to the Palo Alto Networks Security Advisory.

Workarounds

Configure AWS Instance Metadata Service Version 2 (IMDSv2) which requires session tokens and provides additional protection against SSRF-style attacks
Restrict IAM role permissions attached to VM-Series instances to the absolute minimum required for operation
Implement network-level controls to monitor and restrict access to the metadata endpoint from GlobalProtect sessions
Consider deploying additional network segmentation to limit the blast radius of potential credential compromise

bash

# Enable IMDSv2 on AWS VM-Series instance (requires session token for metadata access)
aws ec2 modify-instance-metadata-options \
    --instance-id <your-vm-series-instance-id> \
    --http-tokens required \
    --http-endpoint enabled