Get the latest tech news
Working with PaloAlto to identify CVE-2024-2550
How AC3 assisted in identifying and resolving vulnerabilities in the Palo Alto product suite.
The error revealed a "nil pointer dereference" in the firewall's SSL VPN service, suggesting a backend processing issue rather than a problem with the client frontend. However, this triggered the same error when returning a response (where we expected a pre-login cookie) and every subsequent request reproduced the same “nil pointer dereference” issue, confirming that the bug was consistently repeatable. Upon reviewing the logs, providing steps to reproduce, and discussing the findings, the Palo Alto security team confirmed it was a software flaw.
Or read this on Hacker News