CVE-2020-1975

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

Weakness

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Affected Software

Potential Mitigations

• Always validate XML input against a known XML Schema or DTD.
• It is not possible for an XML parser to validate all aspects of a document’s content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document’s structure and therefore guarantee to the code that processes the document that the content is well-formed.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://security.paloaltonetworks.com/CVE-2020-1975
• https://security.paloaltonetworks.com/CVE-2020-1975