The threat actors are now actively exploiting this Palo Alto ZeroDay in the wild following the PoC release. Palo Alto ZeroDay Exploited Researchers identified vulnerabilities and developed an exploit for GlobalProtect in three days that targeted Palo Alto VPN-SSL solutions.  WatchTowr explained a path traversal bug with a command injection resulting in a PoC via POST request to “…/ssl-vpn/hipreport.esp”.  It permits command injection through the SESSID cookie, which can potentially drop webshells as cron jobs.  Rapid7’s and WatchTowr’s PoCs spread quickly, followed by TrustedSec and ShadowServer reporting on some real attacks, while some of the earlier PoCs were fake or malicious.  Expect widespread attacks soon since Palo Alto solutions are not audited enough.

Source: GBHackers