Palo Alto Expedition - Information Disclosure (CVE-2024-9465)
Description
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
psychologyCrowdSec Analysis
CVE-2024-9465 is a SQL injection vulnerability in Palo Alto Networks Expedition which allows unauthenticated attackers to access sensitive database contents, including password hashes, usernames, device configurations, and API keys. This flaw can also be exploited to create and read arbitrary files on the Expedition system, potentially leading to further compromise and unauthorized access to critical infrastructure.
CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-9465 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /bin/configurations/parsers/Checkpoint/CHECKPOINT.php endpoint by injecting SQL commands into the signatureid parameter, enabling unauthorized database queries and potential remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-09 |
| CISA KEV | 2024-11-14 |
| CISA Remediation Deadline | 2024-12-05 |
| Rule Released | 2025-01-21 |
| CrowdSec First Seen | 2025-12-17 |