CVE-2024-5908: GlobalProtect Information Disclosure Flaw

CVE-2024-5908 Overview

A vulnerability in Palo Alto Networks GlobalProtect application results in the exposure of encrypted user credentials within application logs. The GlobalProtect VPN client inadvertently logs encrypted authentication credentials used for establishing secure connections. While these credentials are encrypted rather than stored in plaintext, their presence in application logs creates an unintended exposure pathway. Under normal circumstances, these logs are only accessible to local users; however, when logs are collected for troubleshooting purposes and shared with support personnel or third parties, the encrypted credentials become exposed to unintended recipients.

Critical Impact

Encrypted user credentials for GlobalProtect VPN connections are exposed in application logs, potentially enabling credential harvesting when logs are shared for troubleshooting or accessed by local users with log file access.

Affected Products

• Palo Alto Networks GlobalProtect (multiple versions)
• GlobalProtect VPN Client
• GlobalProtect Application for Windows, macOS, and Linux

Discovery Timeline

• June 12, 2024 - CVE-2024-5908 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-5908

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), representing an information disclosure flaw in the GlobalProtect application's logging mechanism. The core issue stems from the application's handling of authentication credentials during the VPN connection process, where encrypted credential data is inadvertently written to local application log files.

The exposure occurs through the application's diagnostic logging functionality, which captures more information than necessary during authentication operations. While the credentials are encrypted, their presence in logs violates the principle of least privilege for sensitive data handling. An attacker with access to these log files—either through local system access, log collection processes, or when logs are shared for technical support—could potentially extract and attempt to decrypt these credentials.

The network-based attack vector indicates that credential exposure could be leveraged in scenarios where log files are transmitted over networks for centralized logging or support ticket attachments, expanding the potential attack surface beyond local file access.

Root Cause

The root cause of this vulnerability lies in the GlobalProtect application's logging implementation, which fails to properly sanitize authentication-related data before writing to log files. During the authentication handshake process, the application captures encrypted credential information as part of its diagnostic logging routine. This represents a violation of secure coding practices that dictate sensitive authentication material should never be persisted to log files, regardless of encryption status.

The logging subsystem lacks adequate filtering mechanisms to identify and redact credential-related data from log entries, resulting in sensitive information being written to files that may be accessed by local users or shared externally.

Attack Vector

The attack vector for this vulnerability requires an adversary to gain access to GlobalProtect application log files. This can occur through several scenarios:

1. Local Access: An attacker with local user access to a system running GlobalProtect can read the application logs directly from the file system
2. Log Collection: When logs are generated for troubleshooting and transmitted to support teams or third-party services, the encrypted credentials are exposed to all recipients
3. Centralized Logging: Organizations using centralized log aggregation may inadvertently collect and store these sensitive credentials in their SIEM or log management systems
4. Insider Threat: Users with legitimate access to troubleshooting logs could harvest credentials for malicious purposes

The vulnerability does not require any user interaction beyond the normal generation and sharing of diagnostic logs. The exposure occurs passively whenever authentication activities are logged.

Detection Methods for CVE-2024-5908

Indicators of Compromise

• Unexpected access to GlobalProtect log files by non-administrative users
• Unusual log file read operations on systems running GlobalProtect
• Log files being copied or transmitted to external locations
• Evidence of credential extraction attempts from log data
• Anomalous authentication attempts using potentially compromised credentials

Detection Strategies

• Monitor file access events on GlobalProtect log directories for unauthorized read operations
• Implement Data Loss Prevention (DLP) rules to detect log files containing credential patterns being transmitted externally
• Configure endpoint detection to alert on bulk log file access or extraction
• Audit log sharing processes to identify potential exposure points
• Deploy file integrity monitoring on GlobalProtect log directories

Monitoring Recommendations

• Enable detailed audit logging for file system access to GlobalProtect application directories
• Configure SIEM correlation rules to detect patterns of log file access followed by external data transmission
• Implement user behavior analytics to identify anomalous access to diagnostic log files
• Monitor for authentication failures that could indicate use of harvested credentials
• Review and audit log collection and sharing procedures for GlobalProtect troubleshooting

How to Mitigate CVE-2024-5908

Immediate Actions Required

• Update GlobalProtect to the latest patched version as specified in Palo Alto Networks security advisory
• Review and restrict access permissions on GlobalProtect log directories to essential personnel only
• Audit any recently shared log files and assess potential credential exposure
• Consider rotating credentials for users whose logs may have been exposed
• Implement strict procedures for sanitizing logs before sharing for troubleshooting

Patch Information

Palo Alto Networks has released security updates to address this vulnerability. Administrators should consult the Palo Alto Networks Security Advisory for specific version information and patch downloads. The fix prevents encrypted credentials from being written to application logs during authentication operations.

Organizations should prioritize patching based on their exposure risk, particularly if log files are routinely collected and shared for troubleshooting purposes or if centralized log aggregation is in use.

Workarounds

• Restrict file system permissions on GlobalProtect log directories to prevent unauthorized access
• Implement log file sanitization scripts to remove credential-related entries before sharing logs externally
• Disable verbose logging where possible to reduce the amount of sensitive data captured
• Use secure channels for log transmission and limit log retention periods
• Consider implementing endpoint DLP to prevent log files from being transmitted without inspection

# Configuration example
# Restrict access to GlobalProtect log directory (Windows)
# Run as Administrator
icacls "C:\Program Files\Palo Alto Networks\GlobalProtect\Logs" /inheritance:r
icacls "C:\Program Files\Palo Alto Networks\GlobalProtect\Logs" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Palo Alto Networks\GlobalProtect\Logs" /grant:r "Administrators:(OI)(CI)F"

# For Linux/macOS - restrict log directory permissions
# chmod 700 /opt/paloaltonetworks/globalprotect/logs
# chown root:root /opt/paloaltonetworks/globalprotect/logs