Palo Alto Networks GlobalProtect App 在 Windows 设备上存在一个本地提权漏洞 (CVE-2024-2432)，该漏洞允许本地用户以提升的权限执行程序。然而，执行需要本地用户能够成功利用竞争条件。

🤔 漏洞描述：该漏洞存在于 Palo Alto Networks GlobalProtect App 的 Windows 版本中，允许本地用户在成功利用竞争条件的情况下，以提升的权限执行程序。

🛡️ 影响范围：受影响的版本包括 GlobalProtect App 6.2 版本低于 6.2.1 的版本、GlobalProtect App 6.1 版本低于 6.1.2 的版本、GlobalProtect App 6.0 版本低于 6.0.8 的版本以及 GlobalProtect App 5.1 版本低于 5.1.12 的版本。

💪 解决方法：Palo Alto Networks 已在 GlobalProtect App 5.1.12、GlobalProtect App 6.0.8、GlobalProtect App 6.1.2、GlobalProtect App 6.2.1 及更高版本中修复了该漏洞。建议用户尽快更新到最新版本以获得保护。

⚠️ 漏洞利用：目前，Palo Alto Networks 未发现任何恶意利用该漏洞的迹象。但是，该漏洞的 PoC 代码已公开发布。

🤝 感谢：Palo Alto Networks 感谢 Erwin Chan 发现并报告了该问题。

Palo Alto Networks Security Advisories /CVE-2024-2432CVE-2024-2432 GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityUrgencyMODERATEResponse EffortLOWRecoveryAUTOMATICValue DensityDIFFUSEAttack VectorLOCALAttack ComplexityHIGHAttack RequirementsPRESENTAutomatableNOUser InteractionNONEProduct ConfidentialityLOWProduct IntegrityLOWProduct AvailabilityLOWPrivileges RequiredLOWSubsequent ConfidentialityHIGHSubsequent IntegrityHIGHSubsequent AvailabilityHIGHNVDJSON Published2024-03-13 Updated2024-03-18ReferenceGPC-18129DiscoveredexternallyDescriptionA privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.Product StatusVersionsAffectedUnaffectedGlobalProtect App 6.2< 6.2.1 on Windows>= 6.2.1 on WindowsGlobalProtect App 6.1< 6.1.2 on Windows>= 6.1.2 on WindowsGlobalProtect App 6.0< 6.0.8 on Windows>= 6.0.8 on WindowsGlobalProtect App 5.1< 5.1.12 on Windows>= 5.1.12 on WindowsSeverity:MEDIUMCVSSv4.0Base Score:5.2 (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/AU:N/R:A/V:D/RE:L/U:Amber)Exploitation StatusPalo Alto Networks is not aware of any malicious exploitation of this issue. However, a proof of concept for this issue is publicly available.Weakness TypeCWE-269 Improper Privilege ManagementSolutionThis issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.2, GlobalProtect app 6.2.1, and all later GlobalProtect app versions on Windows.AcknowledgmentsPalo Alto Networks thanks Erwin Chan for discovering and reporting this issue.Timeline2024-03-18Updated Exploitation Status section to indicate availability of a proof of concept2024-03-13Initial publication