Full Report
The authors of this post saw two vulnerabilities under active exploitation in Palo Alto firewalls. So, they reverse engineered the exploit to understand what was going on. The architecture is setup to have three separate components for web processing: Nginx -> Apache -> PHP. First, it's a reverse proxy that sets a bunch of headers. The most important one is X-pan-AuthCheck: on, which indicates to check for authentication downstream. After this, Apache will re-normalize the request and re-process the request with a rewrite rule. Finally, if it's a PHP file, then an authentication check is done based on the header mentioned. Anything you have a protocol that requires parsing complicated data, it's important to consider the differences between the tech stacks. The usage of authentication is set by Nginx and then processed by Apache. If we can trick Nginx to not set this header but have Apache still process it as a PHP request, then we can bypass authentication. From reading previous research from Orange and messing around, the authors noticed some odd functionality within a RewriteRule. In Apache, the RewriteRule may perform an internal redirect. This is important because extra URL decoding may occur! In Nginx, one of the paths that did NOT include the authentication header being set was /unauth. So, the goal is to get Nginx to not set the header yet have Apache use an interesting PHP route. Using the Apache trick from above, URL encoding directory traversal characters can be used to do this. For instance, /unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css will resolve to /unauth/../php/ztp_gate.php/PAN_help/x.css.gz after the multiple URL decodings. Of course, Apache will resolve the ../ now leading to /php/ztp_gate.php/PAN_help/x.css.gz. Parser differential bugs strike again! Overall, a super interesting blog post against the exploitation of a real and impactful vulnerability.
Analysis Summary
# Vulnerability: Nginx/Apache Path Confusion Authentication Bypass in PAN-OS
## CVE Details
- **CVE ID:** CVE-2025-0108
- **CVSS Score:** 9.3 (Critical)
- **CWE:** CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling)
## Affected Systems
- **Products:** Palo Alto Networks PAN-OS (Management Interface)
- **Versions:**
- PAN-OS 10.2 versions < 10.2.14
- PAN-OS 11.0 versions < 11.0.7
- PAN-OS 11.2 versions < 11.2.5
- **Configurations:** Systems where the management interface is accessible and relies on the multi-tiered web architecture (Nginx -> Apache -> PHP).
## Vulnerability Description
The vulnerability stems from a **parser differential** between Nginx (acting as a reverse proxy) and Apache (the downstream web server).
1. **Nginx Layer:** Sets the header `X-pan-AuthCheck: on` by default to enforce authentication. However, it sets this header to `off` if the URI starts with `/unauth/`.
2. **Apache Layer:** Contains a `RewriteRule` for `PAN_help` paths. When a request matches this rule, Apache performs an **internal redirect**, which triggers an additional round of URL decoding.
3. **The Flaw:** An attacker can provide a double-URL-encoded path (e.g., using `%252e%252e` for `..`). Nginx sees `/unauth/` and disables authentication. Apache then decodes the path, resolves the directory traversal (`../`), and routes the request to a sensitive PHP script (like `ztp_gate.php`) while maintaining the "auth-off" status set by Nginx.
## Exploitation
- **Status:** Exploited in the wild (as a zero-day discovery following research into related vulnerabilities).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full authentication bypass to the management interface)
- **Integrity:** High (Ability to access administrative PHP scripts)
- **Availability:** High (Potential for full device takeover when combined with subsequent flaws)
## Remediation
### Patches
Update to the following versions or later:
- PAN-OS 10.2.14
- PAN-OS 11.0.7
- PAN-OS 11.1.x (Consult vendor for specific sub-version)
- PAN-OS 11.2.5
### Workarounds
- **Access Control:** Restrict access to the PAN-OS management interface to a whitelist of trusted IP addresses.
- **Interface Isolation:** Ensure the management interface is not exposed to the public internet.
## Detection
- **Indicators of Compromise:** Look for web server logs containing `/unauth/` followed by double-encoded traversal characters (e.g., `%252e%252e`) and calls to PHP scripts that typically require authentication.
- **Example Pattern:** `GET /unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css`
## References
- **Vendor Advisory:** [Palo Alto Networks Security Advisories](https://security.paloaltonetworks.com/)
- **Original Research:** [slcyber[.]io/research/nginx-apache-path-confusion-to-auth-bypass-in-pan-os-cve-2025-0108](https://www.slcyber.io/research/nginx-apache-path-confusion-to-auth-bypass-in-pan-os-cve-2025-0108)