CVE-2025-0103: Palo Alto Expedition SQLi Vulnerability

CVE-2025-0103 Overview

CVE-2025-0103 is a SQL injection vulnerability in Palo Alto Networks Expedition, the firewall migration and configuration tool. An authenticated attacker can exploit this flaw to extract sensitive database contents, including password hashes, usernames, device configurations, and device API keys. The vulnerability also permits attackers to create and read arbitrary files on the Expedition host. The issue is tracked under CWE-89 and disclosed in PAN-SA-2025-0001.

Critical Impact

An authenticated attacker can extract credentials and API keys for managed firewalls, enabling downstream compromise of network infrastructure that Expedition migrates or configures.

Affected Products

• Palo Alto Networks Expedition (all versions prior to the fixed release)
• Expedition deployments used for firewall configuration migration
• Expedition systems holding cached device API keys and credentials

Discovery Timeline

• 2025-01-11 - CVE-2025-0103 published to the National Vulnerability Database
• 2026-01-23 - Last updated in NVD database

Technical Details for CVE-2025-0103

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. Expedition fails to properly sanitize attacker-controlled input before incorporating it into SQL queries executed against the application database. An authenticated user can submit crafted input that alters query logic and returns data from arbitrary tables.

The Expedition database stores sensitive material used during firewall migration workflows. Successful exploitation reveals password hashes, usernames, device configurations, and device API keys. Beyond data extraction, the flaw enables creation and reading of arbitrary files on the host, expanding the attacker's foothold on the Expedition appliance itself.

Root Cause

The root cause is improper neutralization of special elements in SQL statements. User-supplied parameters reach query construction without parameterized binding or input validation. This permits an attacker to inject SQL syntax that the backend executes with the privileges of the Expedition application database user.

Attack Vector

The attack vector is network-based and requires authentication to the Expedition interface. An attacker with valid credentials, including low-privilege accounts, submits malicious payloads to a vulnerable endpoint. The injected SQL extracts records from configuration and credential tables. The file read and write primitive that follows allows the attacker to stage further actions on the host.

No public proof-of-concept code or exploit module is currently associated with this CVE. Refer to the Palo Alto Networks Security Advisory for vendor-supplied technical context.

Detection Methods for CVE-2025-0103

Indicators of Compromise

• Unexpected SQL syntax, union statements, or comment sequences in Expedition web server access logs
• Anomalous database queries against credential, configuration, or API key tables originating from the Expedition application user
• New or modified files in Expedition application directories that do not correspond to administrative activity
• Authentication events from Expedition service accounts against managed firewalls outside of scheduled migration windows

Detection Strategies

• Inspect Expedition web access logs for query parameters containing SQL metacharacters such as single quotes, UNION SELECT, --, or hex-encoded payloads
• Correlate authenticated Expedition sessions with subsequent database query spikes or unusual table access patterns
• Alert on filesystem write operations performed by the Expedition process outside of expected directories

Monitoring Recommendations

• Forward Expedition application and web server logs to a centralized logging platform for retention and correlation
• Monitor outbound API calls from the Expedition host to managed firewalls for activity that does not match documented migration tasks
• Rotate and monitor any device API keys and credentials stored in Expedition if exposure is suspected

How to Mitigate CVE-2025-0103

Immediate Actions Required

• Upgrade Expedition to the fixed release identified in PAN-SA-2025-0001
• Restrict network access to the Expedition management interface to trusted administrative networks only
• Rotate all credentials, password hashes, and device API keys stored in the Expedition database
• Audit Expedition user accounts and remove unused or stale authentication credentials

Patch Information

Palo Alto Networks published a fixed version of Expedition in PAN-SA-2025-0001. Administrators must apply the vendor-supplied update. Review the advisory for the specific fixed version and any post-upgrade steps required to invalidate previously cached secrets.

Workarounds

• Disable the Expedition service when not actively performing migrations to reduce exposure
• Place Expedition behind a jump host or VPN that enforces strong authentication and network access controls
• Limit Expedition user accounts to the minimum required privileges and disable shared credentials

# Restrict access to the Expedition interface using host-based firewall rules
sudo iptables -A INPUT -p tcp --dport 443 -s <admin_subnet> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP