CVE-2024-5921: GlobalProtect Privilege Escalation Flaw

CVE-2024-5921 Overview

CVE-2024-5921 is an insufficient certificate validation vulnerability affecting the Palo Alto Networks GlobalProtect VPN client application. This security flaw allows attackers to connect the GlobalProtect app to arbitrary malicious servers by exploiting improper certificate validation mechanisms. The vulnerability enables a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently deploy malicious software signed by these fraudulent certificates.

This vulnerability is particularly concerning because it undermines the fundamental trust model of the VPN client, allowing attackers to redirect legitimate VPN connections to attacker-controlled infrastructure. The attack can lead to code execution and privilege escalation through the installation of malicious software packages delivered via the rogue VPN server.

Critical Impact

Attackers can exploit this vulnerability to install malicious root certificates and deploy arbitrary malware signed with those certificates, potentially leading to complete system compromise through privilege escalation.

Affected Products

• Palo Alto Networks GlobalProtect for Windows (all versions prior to patch)
• Palo Alto Networks GlobalProtect for macOS (all versions prior to patch)
• Palo Alto Networks GlobalProtect for Linux (all versions prior to patch)
• Palo Alto Networks GlobalProtect for Android
• Palo Alto Networks GlobalProtect for iOS

Discovery Timeline

• November 27, 2024 - CVE-2024-5921 published to NVD
• June 27, 2025 - Last updated in NVD database

Technical Details for CVE-2024-5921

Vulnerability Analysis

The vulnerability stems from insufficient certificate validation within the GlobalProtect VPN client application. When the GlobalProtect client establishes a connection to a VPN server, it fails to properly validate the server's certificate authenticity. This improper validation allows the client to accept connections from unauthorized servers presenting invalid or malicious certificates.

The security researchers at AmberWolf identified this vulnerability as part of their "NachoVPN" research, demonstrating how VPN clients from multiple vendors can be exploited through insufficient server validation. In the case of GlobalProtect, the vulnerability allows an attacker to set up a malicious VPN server that the client will trust and connect to without proper verification.

Once connected to the malicious server, the attacker gains the ability to push configuration updates, including root certificates, to the victim's endpoint. These malicious root certificates can then be used to sign malware, effectively bypassing code signing verification and allowing arbitrary malicious software to be installed with elevated trust.

Root Cause

The root cause of CVE-2024-5921 is classified under CWE-295 (Improper Certificate Validation). The GlobalProtect client does not adequately verify that the VPN server it connects to is legitimate and authorized. This includes insufficient validation of:

• Server certificate chain integrity
• Certificate authority trust verification
• Hostname validation against presented certificates

The lack of strict certificate pinning or proper validation routines allows the client to establish trusted connections with servers presenting certificates that should not be accepted.

Attack Vector

The attack requires either local access to the system or network proximity (same subnet) to the victim. An attacker exploits this vulnerability through the following attack chain:

1. Server Spoofing: The attacker sets up a malicious VPN server that mimics a legitimate GlobalProtect portal
2. Connection Redirection: Through local system manipulation or network-level attacks (ARP spoofing, DNS poisoning), the attacker redirects the victim's GlobalProtect client to connect to the malicious server
3. Certificate Injection: Upon connection, the malicious server pushes configuration updates that include attacker-controlled root certificates
4. Malware Deployment: With malicious root certificates installed, the attacker can deploy signed malware that the system trusts
5. Privilege Escalation: The malicious software can then execute with elevated privileges, potentially leading to complete system compromise

The attack does not require administrative privileges on the target system, making it exploitable by standard users or attackers with limited network access.

Detection Methods for CVE-2024-5921

Indicators of Compromise

• Unexpected root certificates appearing in the system's certificate store, particularly certificates not issued by recognized Certificate Authorities
• GlobalProtect client connecting to VPN servers with IP addresses or hostnames not matching corporate infrastructure
• Newly installed software with digital signatures from unknown or recently added certificate authorities
• Unusual network traffic patterns showing VPN connections to non-corporate IP addresses

Detection Strategies

• Monitor certificate store modifications for newly added root certificates, especially those without proper organizational attribution
• Implement network monitoring to detect GlobalProtect connections to unauthorized VPN endpoints
• Deploy endpoint detection rules to alert on GlobalProtect configuration file changes
• Audit system logs for unexpected software installations signed by untrusted certificates

Monitoring Recommendations

• Enable verbose logging on GlobalProtect clients to capture connection destinations and certificate details
• Implement SIEM rules correlating VPN connection events with certificate store modifications
• Deploy network-level monitoring to detect potential ARP spoofing or DNS manipulation attempts
• Establish baseline VPN server IP addresses and alert on connections to unknown destinations

How to Mitigate CVE-2024-5921

Immediate Actions Required

• Apply the latest security patches from Palo Alto Networks for all GlobalProtect client installations across Windows, macOS, and Linux platforms
• Review and audit current root certificate stores on all endpoints running GlobalProtect
• Implement network segmentation to limit lateral movement potential from compromised endpoints
• Enable strict certificate validation settings where available in GlobalProtect configurations

Patch Information

Palo Alto Networks has released security updates to address this vulnerability. Organizations should consult the official Palo Alto Networks Security Advisory for specific version information and patch downloads. The advisory provides detailed guidance on affected versions and the remediation steps required for each platform.

For technical details on the vulnerability mechanics and proof-of-concept information, refer to the AmberWolf technical analysis and the NachoVPN GitHub repository.

Workarounds

• Configure firewalls to restrict outbound VPN connections only to known, authorized GlobalProtect portal IP addresses
• Implement application whitelisting to prevent unauthorized software installation regardless of code signing
• Deploy certificate store monitoring tools to detect and alert on unauthorized certificate additions
• Consider disabling automatic GlobalProtect updates and manage client configurations through centralized MDM solutions with strict policy enforcement

# Example: Monitor certificate store changes on Windows (PowerShell)
# Run periodically to detect unauthorized root certificate additions
Get-ChildItem -Path Cert:\LocalMachine\Root | 
    Where-Object {$_.NotBefore -gt (Get-Date).AddDays(-7)} | 
    Select-Object Subject, Issuer, NotBefore, Thumbprint |
    Export-Csv -Path "C:\Security\NewRootCerts.csv" -NoTypeInformation