Authentication Bypass in Palo Alto Networks PAN-OS Management Web Interface
CVE-2025-0108 is an authentication bypass vulnerability in the Palo Alto Networks PAN-OS management web interface. According to the provided content, an unauthenticated attacker with network access to the management web interface can bypass the normal authentication checks and invoke certain PHP scripts. Multiple supporting references indicate the issue is related to incorrect request handling or a request-parsing inconsistency between the Nginx and Apache handlers in PAN-OS, with double URL encoding cited as sufficient to trigger the bypass. The vulnerability affects PAN-OS firewall management interfaces; the content states it does not affect Cloud NGFW or Prisma Access software. While the flaw does not itself provide remote code execution, it enables access to functionality that should require authentication and has been observed being chained with other PAN-OS vulnerabilities in real-world attacks.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (7 hidden).
This repository provides a proof-of-concept (PoC) and a fixed implementation for CVE-2025-0108, which is a path confusion and header smuggling vulnerability in a multi-layer web stack (Nginx -> Flask backend -> Apache/PHP). The repository is structured into two main directories: one for the vulnerable setup ('CVE-2025-0108_vulnerable') and one for the fixed setup ('CVE-2025-0108_fixed'). Each setup contains Dockerfiles for the backend (Flask) and PHP services, as well as Nginx configuration files and a docker-compose.yml to orchestrate the environment. The vulnerable implementation demonstrates how a double-encoded path in an HTTP request can bypass authentication checks due to inconsistent path decoding between Nginx and the backend Flask application. The exploit is performed by sending a specially crafted HTTP request (using curl) to the Nginx proxy, which forwards it to the backend and ultimately allows access to a protected PHP endpoint. The fixed implementation adds additional path normalization and checks in the backend to prevent this bypass. The repository is intended for educational purposes and includes detailed instructions and test cases in the README.md. The main exploit capability is authentication bypass via path confusion and header smuggling, and the main fingerprintable endpoint is the crafted HTTP URL targeting the Nginx proxy and backend services.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate authentication-bypass vulnerability in PAN-OS software that allows an unauthenticated attacker to invoke certain PHP scripts.
An authentication bypass vulnerability in Palo Alto Networks PAN-OS; added to CISA KEV due to active exploitation.
One of multiple PAN-OS vulnerabilities reported as being chained in real-world attacks to compromise Palo Alto Networks firewalls.
An authentication bypass vulnerability in PAN-OS due to request-parsing inconsistencies, allowing unauthenticated access to firewall management interfaces. Exposed hundreds of thousands of firewalls to attack.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.