High-Risk DoS Vulnerability (CVE-2022-0028) in Palo Alto PAN-OS Firewall

Critical DoS Vulnerability (CVE-2022-0028) in Palo Alto Networks PAN-OS Firewall

A serious denial of service (DoS) vulnerability impacting Palo Alto Networks devices with a CVSS score of 8.6 (CVE-2022-0028) is creating potential security risks. Affecting hardware, virtual, and containerized firewall series (PA, VM, and CN), this flaw stems from an incorrect setting in PAN-OS URL filtering policies that can allow network-based attackers to launch mirrored and amplified TCP DoS attacks.

The PAN-OS DoS vulnerability does not compromise confidentiality, integrity, or availability of Palo Alto's devices directly. However, it poses a high risk as it enables attackers to mask their identity by making the firewall appear as the origin of the attack, which can obscure the attack’s true source and significantly impede incident response and threat attribution efforts.

Which PAN-OS Versions Are Vulnerable to CVE-2022-0028?

The CVE-2022-0028 vulnerability impacts Palo Alto Networks PAN-OS versions, as listed below, with updates made available by Palo Alto on August 15, 2022. The affected PAN-OS versions are as follows:

• PAN-OS 10.2: <10.2.2-h2 (Patched in version 10.2.2-h2)
• PAN-OS 10.1: <10.1.6-h6 (Patched in version 10.1.6-h6)
• PAN-OS 10.0: <10.0.11-h1 (Patched in version 10.0.11-h1)
• PAN-OS 9.1: <9.1.14-h4 (Patched in version 9.1.14-h4)
• PAN-OS 9.0: <9.0.16-h3 (Patched in version 9.0.16-h3)
• PAN-OS 8.1: <8.1.23-h1 (Patched in version 8.1.23-h1)

Understanding the Nature of CVE-2022-0028 and the Risks

This DoS vulnerability is unusual because it originates from a URL filtering policy misconfiguration within PAN-OS. When URL filtering is improperly configured, the firewall can inadvertently process TCP requests in such a way that it mirrors and amplifies traffic against a designated target.

Palo Alto Networks Recommendations and Mitigation Steps

To protect against this vulnerability, Palo Alto Networks recommends users update to the latest PAN-OS patches. The patches that address CVE-2022-0028 specifically adjust URL filtering settings to prevent the conditions that allow a mirrored TCP DoS attack.

For PAN-OS users, Palo Alto provides the following immediate steps for mitigation:

1. Update PAN-OS Versions: Upgrading to the patched PAN-OS versions listed above will close the vulnerability.
2. Review URL Filtering Policies: Ensure URL filtering policies are configured securely and appropriately. Regular audits can help identify potential misconfigurations that could lead to similar issues.
3. Use Threat Intelligence and Monitoring Tools: Leverage threat intelligence to monitor for signs of unusual firewall activity that could indicate abuse by attackers. Tracking atypical traffic patterns can help you quickly detect any attempts to exploit vulnerabilities within firewall configurations.

In particular, this vulnerability allows attackers to use the PAN-OS firewall itself as part of the attack. By doing so, they can point the TCP DoS attack toward a specified target while using the Palo Alto device to amplify and reflect this malicious traffic. This not only masks the true origin but also implicates the firewall itself as the source, creating confusion for security response teams.

For those managing high-stakes or highly exposed systems, consider Palo Alto’s Keepnet Human Risk Management Platform for thorough monitoring of user actions and behavior that could expose security gaps.

For a complete breakdown on best practices in security awareness, Palo Alto Networks offers the Keepnet Labs Security Awareness Training that guides IT and security teams through essential security configurations to prevent exploitable scenarios like this.

Implications for Security Teams and the Importance of Proactive Patching

Proactive vulnerability management and fast patching cycles are crucial for staying ahead of these types of threats. Even a minor misconfiguration can quickly escalate into an exploitable vulnerability if it allows attackers to leverage enterprise infrastructure for malicious activities. In the case of CVE-2022-0028, allowing attackers to disguise their actions through your infrastructure not only adds security risk but also could damage the organization’s reputation as the true source of the attack.

Security Awareness and Proactive Defense

Security awareness is an essential complement to effective patch management. Investing in solutions like Phishing Simulators and Awareness Educators enables users to recognize signs of malicious activity while ensuring that IT teams maintain best practices for network defenses. Read more on the role of security awareness training in reducing human error for deeper insights into proactive defense.

For more insights into Denial of Service (DoS) attack prevention, explore Palo Alto’s dedicated blog posts on incident response for DoS attacks and threat response management for complex environments.

Editor’s note: This blog was updated November 12, 2024