Palo Alto Networks Security Advisories / CVE-2024-9469

CVE-2024-9469 Cortex XDR Agent: Local Windows User Can Disable the Agent

047910
Severity 5.7 · MEDIUM
Urgency MODERATE
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector LOCAL
Attack Complexity LOW
Attack Requirements PRESENT
Automatable NO
User Interaction NONE
Product Confidentiality NONE
Product Integrity NONE
Product Availability HIGH
Privileges Required LOW
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE

Description

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.

Product Status

VersionsAffectedUnaffected
Cortex XDR Agent 8.6NoneAll
Cortex XDR Agent 8.5NoneAll
Cortex XDR Agent 8.4< 8.4.1 on Windows>= 8.4.1 on Windows
Cortex XDR Agent 8.3-CENoneAll
Cortex XDR Agent 8.3< 8.3.1 on Windows>= 8.3.1 on Windows
Cortex XDR Agent 7.9-CE< 7.9.102-CE on Windows>= 7.9.102-CE on Windows

Severity: MEDIUM

CVSSv4.0 Base Score: 5.7 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-754: Improper Check for Unusual or Exceptional Conditions

Solution

This issue is fixed in Cortex XDR Agent 7.9.102-CE, Cortex XDR Agent 8.3.1, Cortex XDR Agent 8.4.1, and all later Cortex XDR Agent versions.

Acknowledgments

Palo Alto Networks thanks Orange Cyberdefense Switzerland's Research Team for discovering and reporting this issue.

CPEs

cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.4.0:-:*:*:*:*:*:*

cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.3.0:-:*:*:*:*:*:*

cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9-CE:-:*:*:*:*:*:*

cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9.101-CE:-:*:*:*:*:*:*

Timeline

Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.