[HIGH PRIORITY] Palo Alto Expedition Tool RCE (CVE-2024-8957)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-8957 is an unauthenticated remote code execution flaw in Palo Alto Networks Expedition migration tool (runs on Linux). Attackers steal PAN-OS firewall configs, credentials, and API keys from migration projects.

Affected Expedition

• Expedition before 1.2.30
• Expedition servers on Ubuntu/RHEL with port 443 exposed
• Migration projects containing production firewall exports

Detect exposure

ss -tlnp | grep 443
curl -sk https://expedition.internal/ | grep -i expedition
grep -R Expedition /opt/ 2>/dev/null

Patching Method

1. Download Expedition 1.2.30+ from Palo Alto support portal.
2. Stop Expedition service on Linux host.
3. Backup /opt/expedition project database and exports.
4. Run vendor upgrade script or replace container/image per KB.
5. Restart service; verify version in Expedition web UI.
6. Rotate all PAN-OS API keys and admin passwords stored in Expedition projects.
7. Re-import firewall configs from clean backups if compromise suspected.

systemctl status expedition 2>/dev/null
find /opt/expedition -mtime -7 -type f -ls 2>/dev/null

Hardening

• Never expose Expedition to internet — internal VLAN only
• Delete migration projects after cutover
• Encrypt stored firewall exports at rest