Keepnet Labs Logo
Menu
HOME > blog > palo alto networks devices running the pan os could allow attacker to launch dos attack

High-Risk DoS Vulnerability (CVE-2022-0028) in Palo Alto PAN-OS Firewall

Palo Alto Networks PAN-OS vulnerability CVE-2022-0028 (CVSS score 8.6) could lead to a mirrored, amplified TCP DoS attack. Learn which versions are affected and how to mitigate the risk.

High-Risk DoS Vulnerability (CVE-2022-0028) in Palo Alto PAN-OS Firewall

Critical DoS Vulnerability (CVE-2022-0028) in Palo Alto Networks PAN-OS Firewall

A serious denial of service (DoS) vulnerability impacting Palo Alto Networks devices with a CVSS score of 8.6 (CVE-2022-0028) is creating potential security risks. Affecting hardware, virtual, and containerized firewall series (PA, VM, and CN), this flaw stems from an incorrect setting in PAN-OS URL filtering policies that can allow network-based attackers to launch mirrored and amplified TCP DoS attacks.

The PAN-OS DoS vulnerability does not compromise confidentiality, integrity, or availability of Palo Alto's devices directly. However, it poses a high risk as it enables attackers to mask their identity by making the firewall appear as the origin of the attack, which can obscure the attack’s true source and significantly impede incident response and threat attribution efforts.

Which PAN-OS Versions Are Vulnerable to CVE-2022-0028?

The CVE-2022-0028 vulnerability impacts Palo Alto Networks PAN-OS versions, as listed below, with updates made available by Palo Alto on August 15, 2022. The affected PAN-OS versions are as follows:

  • PAN-OS 10.2: <10.2.2-h2 (Patched in version 10.2.2-h2)
  • PAN-OS 10.1: <10.1.6-h6 (Patched in version 10.1.6-h6)
  • PAN-OS 10.0: <10.0.11-h1 (Patched in version 10.0.11-h1)
  • PAN-OS 9.1: <9.1.14-h4 (Patched in version 9.1.14-h4)
  • PAN-OS 9.0: <9.0.16-h3 (Patched in version 9.0.16-h3)
  • PAN-OS 8.1: <8.1.23-h1 (Patched in version 8.1.23-h1)

Understanding the Nature of CVE-2022-0028 and the Risks

This DoS vulnerability is unusual because it originates from a URL filtering policy misconfiguration within PAN-OS. When URL filtering is improperly configured, the firewall can inadvertently process TCP requests in such a way that it mirrors and amplifies traffic against a designated target.

Palo Alto Networks Recommendations and Mitigation Steps

To protect against this vulnerability, Palo Alto Networks recommends users update to the latest PAN-OS patches. The patches that address CVE-2022-0028 specifically adjust URL filtering settings to prevent the conditions that allow a mirrored TCP DoS attack.

For PAN-OS users, Palo Alto provides the following immediate steps for mitigation:

  1. Update PAN-OS Versions: Upgrading to the patched PAN-OS versions listed above will close the vulnerability.
  2. Review URL Filtering Policies: Ensure URL filtering policies are configured securely and appropriately. Regular audits can help identify potential misconfigurations that could lead to similar issues.
  3. Use Threat Intelligence and Monitoring Tools: Leverage threat intelligence to monitor for signs of unusual firewall activity that could indicate abuse by attackers. Tracking atypical traffic patterns can help you quickly detect any attempts to exploit vulnerabilities within firewall configurations.

In particular, this vulnerability allows attackers to use the PAN-OS firewall itself as part of the attack. By doing so, they can point the TCP DoS attack toward a specified target while using the Palo Alto device to amplify and reflect this malicious traffic. This not only masks the true origin but also implicates the firewall itself as the source, creating confusion for security response teams.

For those managing high-stakes or highly exposed systems, consider Palo Alto’s Keepnet Human Risk Management Platform for thorough monitoring of user actions and behavior that could expose security gaps.

For a complete breakdown on best practices in security awareness, Palo Alto Networks offers the Keepnet Labs Security Awareness Training that guides IT and security teams through essential security configurations to prevent exploitable scenarios like this.

Implications for Security Teams and the Importance of Proactive Patching

Proactive vulnerability management and fast patching cycles are crucial for staying ahead of these types of threats. Even a minor misconfiguration can quickly escalate into an exploitable vulnerability if it allows attackers to leverage enterprise infrastructure for malicious activities. In the case of CVE-2022-0028, allowing attackers to disguise their actions through your infrastructure not only adds security risk but also could damage the organization’s reputation as the true source of the attack.

Security Awareness and Proactive Defense

Security awareness is an essential complement to effective patch management. Investing in solutions like Phishing Simulators and Awareness Educators enables users to recognize signs of malicious activity while ensuring that IT teams maintain best practices for network defenses. Read more on the role of security awareness training in reducing human error for deeper insights into proactive defense.

For more insights into Denial of Service (DoS) attack prevention, explore Palo Alto’s dedicated blog posts on incident response for DoS attacks and threat response management for complex environments.

Editor’s note: This blog was updated November 12, 2024

SHARE ON

twitter
linkedin
facebook

Schedule your 30-minute demo now

You'll learn how to:
tickIdentify and prioritize vulnerabilities in your network with efficient monitoring techniques.
tickStrengthen DoS protections with custom configurations and up-to-date patching.
tickLeverage security awareness training to reduce misconfiguration and enhance staff response.
iso 27017 certificate
iso 27018 certificate
iso 27001 certificate
ukas 20382 certificate
Cylon certificate
Crown certificate
Gartner certificate
Tech Nation certificate