terminaljunki3 / cve-2024-3400-checker

Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.

Palo Vulnerability Check - CVE-2024-3400

Overview

This script is designed to check for signs of compromise in Palo systems, specifically for the vulnerability identified as CVE-2024-3400. It searches through tech support package gz or .tgz archive files for specific log entries that may indicate a security breach.

Prerequisites

• Python 3.x
• Access to the .tar.gz file containing Palo logs.

Usage

1. Ensure you have a .tar.gz tech supprot file containing the relevant Palo logs.
2. Modify the filepath variable in the script to point to your .tar.gz file.
3. Optional - Update the search_terms list with the terms that are indicative of the CVE-2024-3400 vulnerability.
4. Run the script in a Python environment.

How It Works

• The script will decompress the .tar.gz file and search through the specified log files.
• If it finds any of the search terms, it will print the matching lines and advise you to follow remediation guidance and share the files with the vendor.
• If no matches are found, it will print a message indicating that no compromise was detected, but still recommend sharing the file with the vendor for certainty.

Example

# Replace this with your actual file path
filepath = r'path to techsupport.tgz'

Important Notes

• The script stops searching after finding the first set of matches. If you need a full search, remove the return statement after printing matches.
• The script is a basic tool for initial checks and does not replace professional forensic analysis.
• Always ensure you have the latest updates and patches applied to your Palo systems to prevent vulnerabilities like CVE-2024-3400.

Contributing

If you have suggestions for improving this script or have found a bug, please open an issue or a pull request with your changes.