Loading vulnerability…
CVE-2025-0133 is a reflected cross-site scripting vulnerability in the GlobalProtect gateway and portal features of Palo Alto Networks PAN-OS. The flaw allows malicious JavaScript to execute in the browser context of an authenticated Captive Portal user when the user follows a specially crafted link. The issue affects the web-facing GlobalProtect functionality and is primarily exploitable as a phishing and credential-theft vector rather than as a means to alter device configuration or service behavior. Risk is elevated in deployments where Clientless VPN is enabled, because that feature increases the confidentiality exposure associated with stolen user credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (6 hidden).
This repository is a real exploit/validation toolkit for CVE-2025-0133, a reflected XSS in Palo Alto Networks PAN-OS GlobalProtect gateway/portal at /ssl-vpn/getconfig.esp via the user parameter. It is not tied to a major exploit framework; instead it is a standalone Python pipeline plus a separate browser PoC. Repository structure: README and docs explain the vulnerability, ethics, and methodology; src/ contains the operational code; tests/ validates the scope-matching safety logic; xss.html is the human-verifiable exploit PoC; scripts/install-pre-commit.sh is only a developer safety helper for preventing secret commits. The main operational entry point is src/pipeline.py, which exposes discrete CLI stages: discover, scope, validate, report, and run. Core capabilities: 1. Discovery: src/shodan_search.py queries Shodan using three GlobalProtect-focused dorks and normalizes results into candidate PAN-OS targets. 2. Scope filtering: src/scope_check.py downloads bug bounty scope data from arkadiyt/bounty-targets-data and optionally augments with platform APIs. It matches discovered IPs/hostnames against URL, wildcard, IP, and CIDR assets. This is a major safety boundary and is backed by tests. 3. Validation: src/validator.py performs one GET request per in-scope host to /ssl-vpn/getconfig.esp using canonical GlobalProtect parameters and a unique canary in the user parameter. It checks whether raw metacharacters are reflected unencoded (confirmed), encoded (reflected), absent (clean), or unreachable (error). The validator disables TLS verification and uses a configurable User-Agent. 4. Reporting: src/reporter.py generates Markdown drafts for confirmed findings, including the exact request URL, canary, response excerpt, remediation guidance, and a prefilled PoC URL. 5. Browser exploitation: xss.html is the actual exploit PoC. It redirects a browser to the vulnerable endpoint with an SVG/script payload that triggers prompt("XSS") if the target is vulnerable. Main exploit behavior: the automated Python code is primarily a safe validation and reporting pipeline rather than a mass exploitation tool, but it still actively probes targets and confirms exploitability conditions. The actual exploit payload is in xss.html and in the report template’s reproduction URL. Successful exploitation yields JavaScript execution in the trust context of the GlobalProtect portal, enabling phishing overlays, credential theft, and potentially session theft in Clientless VPN scenarios. Notable observables: the vulnerable endpoint path is /ssl-vpn/getconfig.esp; the request includes fixed parameters such as client-type=1, protocol-version=p1, app-version=3.0.1-10, clientos=Linux, os-version=linux-64, hmac-algo=sha1,md5, enc-algo=aes-128-cbc,aes-256-cbc, authcookie=12cea70227d3aafbf25082fac1b6f51d, portal=us-vpn-gw-N, domain=(empty_domain), and computer=computer. Discovery relies on Shodan dorks rather than hardcoded victim hosts. Overall, this is an operational bug-hunting toolkit for identifying, safely validating, and documenting CVE-2025-0133 exposure on internet-facing PAN-OS GlobalProtect deployments, with a separate HTML PoC for direct browser-based XSS demonstration.
This repository provides a proof-of-concept (POC) exploit for CVE-2025-0133, a reflected cross-site scripting (XSS) vulnerability in the GlobalProtect gateway and portal features of Palo Alto Networks PAN-OS. The exploit consists of a crafted URL targeting the '/ssl-vpn/getconfig.esp' endpoint, with a malicious 'user' parameter containing an SVG-based JavaScript payload. The README.md details the vulnerability, affected versions, and potential impact, while POC.txt provides the exact payload and usage example. The exploit requires tricking an authenticated user into clicking the malicious link, resulting in arbitrary JavaScript execution in their browser. No executable code is present; the repository is a POC demonstrating the vulnerability via a crafted URL.
This repository contains a Python-based proof-of-concept exploit targeting a reflected XSS vulnerability in the GlobalProtect SSL VPN endpoint at /ssl-vpn/getconfig.esp. The exploit works by appending a crafted SVG-based JavaScript payload to the 'user' parameter in the endpoint's query string. The main file, exploit.py, takes a base URL as input, constructs the full exploit URL with the payload, and sends a GET request to the target. It then checks if the payload is reflected in the response, indicating a successful XSS. The README provides usage instructions and a preview of the payload. The repository is structured simply, with one exploit script and a README, and is intended to demonstrate the vulnerability rather than provide a weaponized or automated attack tool.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.