Skip to content

Palo Alto GlobalProtect : Remote Full Compromise Exploit Chain#

hack.lu 2025 digest Program Core pick 21–24 October 2025

Abstract Slides Recording

Maxime Escourbiac (Michelin CERT)

Play the recording: Palo Alto GlobalProtect : Remote Full Compromise Exploit Chain

  • Why: The VPN client is the trust anchor of enterprise remote access. A same-network attacker achieving RCE and SYSTEM on Windows via the client is a realistic rogue-AP/hotel scenario, and the chain runs through broken certificate verification and root CA management — core PKI trust problems.
  • What: Six CVEs in the Palo Alto GlobalProtect client (CVE-2024-5921, CVE-2025-0117, CVE-2025-0118, CVE-2025-0120, CVE-2025-0131, CVE-2025-2183) chained to full remote compromise: certificate-verification bypass to impersonate the VPN portal, arbitrary root CA insertion, HTA payload delivery through the embedded authentication browser for RCE, and privilege escalation to SYSTEM via the impersonation mechanism or weak system update. (from abstract only)
  • How: Systematic weaknesses in certificate verification, root CA management, embedded-browser authentication, and client-server communications; the talk walks each step toward a full chain.
  • Where applicable: Windows workstations running the GlobalProtect client; the attacker must be on the same network as the victim (not internet-remote). Vendor-specific to Palo Alto.