Vulnerabilities > CVE-2020-1987 - Information Exposure Through Log Files vulnerability in Paloaltonetworks Globalprotect

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
local
low complexity
paloaltonetworks
CWE-532
nessus
NVD
Published: 2020-04-08
Updated: 2021-09-14

Summary

An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.

Vulnerable Configurations

Part Description Count
Application
Paloaltonetworks
21

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Fuzzing and observing application log data/errors for application mapping
    An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idPALO_ALTO_GLOBALPROTECT_AGENT_MACOS_CVE-2020-1987.NASL
    descriptionThe version of Palo Alto GlobalProtect Agent installed on the remote macOS or Mac OS X host is 5.0.x prior to 5.0.9, or 5.1.x prior to 5.1.1. It is, therefore, affected by an information disclosure vulnerability due to extra information provided when the troubleshooting log level is set to
    last seen2020-04-30
    modified2020-04-22
    plugin id135903
    published2020-04-22
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135903
    titlePalo Alto GlobalProtect Agent 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Information Disclosure
    code
    #
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(135903);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/23");

  script_cve_id("CVE-2020-1987");
  script_xref(name:"IAVA", value:"2020-A-0137");

  script_name(english:"Palo Alto GlobalProtect Agent 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"A VPN client installed on remote macOS or Mac OS X host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Palo Alto GlobalProtect Agent installed on the remote macOS or Mac OS X host is 5.0.x prior to 5.0.9, or
5.1.x prior to 5.1.1. It is, therefore, affected by an information disclosure vulnerability due to extra information
provided when the troubleshooting log level is set to 'Dump'. An authenticated, local attacker can exploit this to
disclose potentially sensitive information, including VPN cookie information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.paloaltonetworks.com/CVE-2020-1987");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Palo Alto GlobalProtect Agent 5.0.9, 5.1.1, or later");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1987");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:paloaltonetworks:globalprotect");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_globalprotect_agent_mac_installed.nbin");
  script_require_keys("installed_sw/GlobalProtect", "Host/MacOSX/Version");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit("Host/MacOSX/Version");

app_info = vcf::get_app_info(app:'GlobalProtect');

# Change app name for better reporting
app_info.app = 'Palo Alto GlobalProtect Agent';

vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  {'min_version' : '5.0', 'fixed_version' : '5.0.9'},
  {'min_version' : '5.1', 'fixed_version' : '5.1.1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_NOTE);
  • NASL familyWindows
    NASL idPALO_ALTO_GLOBALPROTECT_AGENT_CVE-2020-1987.NASL
    descriptionThe version of Palo Alto GlobalProtect Agent installed on the remote Windows host is 5.0.x prior to 5.0.9, or 5.1.x prior to 5.1.1. It is, therefore, affected by an information disclosure vulnerability due to extra information provided when the troubleshooting log level is set to
    last seen2020-04-30
    modified2020-04-22
    plugin id135904
    published2020-04-22
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135904
    titlePalo Alto GlobalProtect Agent 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Information Disclosure
    code
    #
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(135904);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/23");

  script_cve_id("CVE-2020-1987");
  script_xref(name:"IAVA", value:"2020-A-0137");

  script_name(english:"Palo Alto GlobalProtect Agent 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"A VPN client installed on remote Windows host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Palo Alto GlobalProtect Agent installed on the remote Windows host is 5.0.x prior to 5.0.9, or 5.1.x
prior to 5.1.1. It is, therefore, affected by an information disclosure vulnerability due to extra information provided
when the troubleshooting log level is set to 'Dump'. An authenticated, local attacker can exploit this to disclose
potentially sensitive information, including VPN cookie information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.paloaltonetworks.com/CVE-2020-1987");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Palo Alto GlobalProtect Agent 5.0.9, 5.1.1, or later");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1987");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:paloaltonetworks:globalprotect");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_globalprotect_agent_win_installed.nbin");
  script_require_keys("installed_sw/Palo Alto GlobalProtect Agent", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

app_info = vcf::get_app_info(app:'Palo Alto GlobalProtect Agent', win_local:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  {'min_version' : '5.0', 'fixed_version' : '5.0.9'},
  {'min_version' : '5.1', 'fixed_version' : '5.1.1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_NOTE);

References