Palo Alto Networks PAN-OS: Reflected Cross-Site Scripting (CVE-2025-0133)

CVE-2025-0133 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the GlobalProtect portal and gateway login pages in Palo Alto Networks' PAN-OS. The vulnerability stems from the improper sanitization of the 'user' query parameter when reflected in the Captive Portal page. An unauthenticated attacker can leverage this flaw to execute arbitrary JavaScript in the context of a victim's session. Publicly available proof-of-concept scripts have been released on Sploitus, increasing the risk of reconnaissance or targeted exploitation.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the victim's browser session. This can lead to session hijacking, credential theft, or the execution of malicious actions on behalf of an authenticated user interacting with the compromised login page.

Recommendation

• Inventory all internet-facing Palo Alto Networks GlobalProtect portal and gateway instances.
• Review vendor advisories for specific patch or mitigation guidance related to CVE-2025-0133.
• Prioritize the implementation of security patches on all exposed GlobalProtect gateways.
• Deploy Web Application Firewall (WAF) rules to inspect and sanitize the 'user' query parameter on the '/ssl-vpn/getconfig.esp' path.