CVE-2022-0016: GlobalProtect Privilege Escalation Flaw

CVE-2022-0016 Overview

CVE-2022-0016 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app. The flaw exists within the Connect Before Logon feature and stems from improper handling of exceptional conditions [CWE-703, CWE-755]. A local attacker authenticating through Connect Before Logon under specific circumstances can escalate to SYSTEM privileges on Windows or root privileges on macOS. The issue affects GlobalProtect app 5.2 versions earlier than 5.2.9 on Windows and macOS. Other platforms are not affected.

Critical Impact

Local attackers can obtain SYSTEM or root privileges on workstations running vulnerable versions of the GlobalProtect app, leading to full host compromise.

Affected Products

• Palo Alto Networks GlobalProtect app 5.2 versions earlier than 5.2.9
• Microsoft Windows (GlobalProtect installations)
• Apple macOS (GlobalProtect installations)

Discovery Timeline

• 2022-02-10 - CVE-2022-0016 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0016

Vulnerability Analysis

The GlobalProtect app's Connect Before Logon (CBL) feature establishes a VPN tunnel before a user signs into the operating system. To do this, the agent runs portions of the authentication workflow with elevated privileges. CVE-2022-0016 arises when the agent fails to correctly handle exceptional conditions during this pre-logon authentication flow.

When the error path is reached under specific circumstances, the privileged context is not properly contained. A local attacker present at the logon screen can leverage the exposed workflow to execute actions in the SYSTEM context on Windows or root on macOS. The vulnerability requires local access but no prior interactive session, making it usable by anyone with physical or remote console access to an affected host.

The weakness is categorized under improper check or handling of exceptional conditions [CWE-703] and improper handling of exceptional conditions [CWE-755]. Both classifications reflect logic errors in how the GlobalProtect agent responds to unexpected states during pre-logon authentication.

Root Cause

The root cause is improper handling of exceptional conditions inside the Connect Before Logon authentication path of the GlobalProtect agent service. The privileged service does not safely terminate or downgrade its execution context when the authentication operation encounters certain unexpected states.

Attack Vector

Exploitation requires local access to a Windows or macOS endpoint running GlobalProtect app 5.2 earlier than 5.2.9 with Connect Before Logon enabled. The attacker interacts with the pre-logon authentication interface and triggers the exceptional condition to inherit the agent's elevated privileges. No valid OS user credentials are required, and no user interaction beyond reaching the logon screen is needed.

No public proof-of-concept code or exploit has been published for this issue. Refer to the Palo Alto Networks CVE-2022-0016 advisory for vendor-confirmed technical details.

Detection Methods for CVE-2022-0016

Indicators of Compromise

• Unexpected processes spawned by the GlobalProtect agent service (PanGPS.exe on Windows, GlobalProtect helper on macOS) running as SYSTEM or root.
• Child processes such as cmd.exe, powershell.exe, or shell binaries launched from the GlobalProtect service prior to user logon.
• Local accounts created or privileges modified at the pre-logon stage of a host.

Detection Strategies

• Inventory endpoints running GlobalProtect app 5.2.x and flag any version below 5.2.9 with Connect Before Logon enabled.
• Hunt for privileged child processes of the GlobalProtect agent that occur before any interactive user session is established.
• Correlate logon events with GlobalProtect service activity to identify abnormal pre-logon command execution.

Monitoring Recommendations

• Enable process creation logging (Windows Event ID 4688, macOS Endpoint Security) and alert on GlobalProtect-spawned children.
• Monitor changes to local Administrators or admin group membership occurring at the logon screen.
• Track GlobalProtect application version across managed endpoints to confirm patch coverage.

How to Mitigate CVE-2022-0016

Immediate Actions Required

• Upgrade the GlobalProtect app to version 5.2.9 or later on all affected Windows and macOS endpoints.
• If patching is not immediately possible, disable the Connect Before Logon feature in the GlobalProtect portal configuration.
• Restrict physical and remote console access to endpoints that cannot yet be patched.

Patch Information

Palo Alto Networks resolved CVE-2022-0016 in GlobalProtect app 5.2.9 for Windows and macOS. Customers should deploy 5.2.9 or any later supported release. Full vendor guidance is published in the Palo Alto Networks CVE-2022-0016 advisory.

Workarounds

• Disable Connect Before Logon (CBL) in the GlobalProtect portal until endpoints are upgraded to 5.2.9 or later.
• Limit who can reach the pre-logon screen by enforcing physical security and disabling remote console exposure for unpatched workstations.
• Enforce endpoint application allowlisting to prevent unauthorized binaries from executing in the SYSTEM or root context.

# Verify installed GlobalProtect version
# Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Palo Alto Networks\GlobalProtect\Settings" | Select-Object Version

# macOS (Terminal)
defaults read /Applications/GlobalProtect.app/Contents/Info.plist CFBundleShortVersionString