A denial-of-service vulnerability was identified this month in Palo Alto Networks PAN-OS software. This week, the Cybersecurity and Infrastructure Agency (CISA), a branch of the US government, have added this vulnerability to their list of known exploited vulnerabilities. Tracked as CVE-2022-0028, this flaw affects the URL filtering policy in multiple versions of PAN-OS running on PA-Series, VM-Series and CN-series devices. A Palo Alto Network security advisory was released when this vulnerability was first discovered, and patches have since been released for all affected versions of the software. CVE-2022-0028 has a CVSS base score of 8.6/10 and is considered to be a ‘high’ severity flaw. 

A filtering policy misconfiguration in the affected versions of PAN-OS allows attackers within the network to execute a reflected and amplified TCP denial-of-service attack. The attacker can exploit this vulnerability to magnify the generation of malicious traffic and render the compromised device unavailable to the user for its expected functions. This network-based attack also allows the attacker to obfuscate their identity, by indicating the firewall of the compromised system as the attack origin. This flaw can also be exploited in a remote attack if the configuration of the URL filtering profile has a source zone with an external facing network in which a security rule for one or more blocked categories is hosted.  

The ability to perform an external attack is suspected to be due to this configuration existing unintentionally, rather than by the system administrator’s design. Because of this, remote exploitation of this flaw can be mitigated by removing this configuration. As patches have been released by the vendor, the best way to protect all affected devices from attack is to update the software to the most recent version. Fixed versions of the PAN-OS are: PAN-OS 8.1.23-h1, PAN-OS 9.0.16-h3, PAN-OS 9.1.14-h4, PAN-OS 10.0.11-h1, PAN-OS 10.1.6-h6, PAN-OS 10.2.2-h2, and all later PAN-OS versions. If updates are unable to be applied, workarounds to mitigate this flaw also exist. Palo Alto Networks advise configuring the network firewalls on affected devices by enabling a packet-based attack protection or a flood protection policy can protect the device from this DoS attack.