Critical · published June 22, 2021
🚨 An attacker can exploit improper authorization in Cortex XSOAR with just network access, making this vulnerability a serious threat! 🔥 Think of it like a restaurant where a patron can access the kitchen simply by walking through an unlocked door. They can change recipes, steal ingredients, or even serve themselves — creating chaos without anyone being the wiser! With this vulnerability, an unauthenticated attacker can perform unauthorized actions through the REST API, potentially compromising sensitive operations and data on the Cortex XSOAR server. This could lead to a complete breakdown of security measures, putting your entire network at risk!
Think of it like a restaurant where a patron can access the kitchen simply by walking through an unlocked door. They can change recipes, steal ingredients, or even serve themselves — creating chaos without anyone being the wiser! This vulnerability arises from improper authorization checks within the Cortex XSOAR server's REST API, allowing remote attackers to perform actions as if they were authorized users, without any authentication required.
With this vulnerability, an unauthenticated attacker can perform unauthorized actions through the REST API, potentially compromising sensitive operations and data on the Cortex XSOAR server. This could lead to a complete breakdown of security measures, putting your entire network at risk! To protect your systems, ensure you're using Cortex XSOAR 6.1.0 builds between 1016923 and 1271064 or 6.2.0 builds prior to 1271065, and upgrade to the patched versions immediately. If you're using an instance hosted by Palo Alto Networks, you're already safe with no further action required! You've got this! By following these steps, you'll be a security hero, keeping your network secure! 🦸