Background: From MigrationTool to Expedition
During a penetration test engagement in 2018, CyberOne’s offensive security team encountered Palo Alto Networks’ firewall policy migration tool — at the time called MigrationTool. The assessment found significant issues: unauthenticated disclosure of passwords, configuration hashes, version information, and system data that no unauthenticated user should be able to access.
When CyberOne reported the findings to Palo Alto Networks, the response was informative: Palo Alto had already retired MigrationTool and replaced it with a new product called Expedition. The PSIRT team encouraged CyberOne to assess Expedition for similar issues — a rare and welcome invitation that speaks to Palo Alto’s security culture at the time.
Expedition: What Changed From MigrationTool
Expedition is a VM-based migration and security policy optimization tool, distributed free by Palo Alto Networks. It assists in migrating firewall policies from third-party vendors to Palo Alto NGFW format and in optimizing existing Palo Alto policies. Because it handles firewall configuration data — including credentials, policy objects, and network topology — its security matters.
CyberOne’s assessment found that Palo Alto had made substantial security improvements in Expedition compared to MigrationTool. The unauthenticated credential disclosure issues that existed in MigrationTool were gone. The web interface required authentication for the functions that previously exposed sensitive data.
However, in reviewing the unauthenticated web code paths — functionality accessible without authentication by design — one file stood out: checkPidStatus.php.
The Vulnerability: Path Traversal in checkPidStatus.php
CVE: CVE-2018-10142
Security Advisory: PAN-SA-2018-0016
Version Tested: Expedition 1.0.106
The checkPidStatus.php file was designed to check whether a specific process was running by accepting a pid value via HTTP GET request and querying the Linux /proc/ filesystem.
The code’s implementation used file_exists() to check the path /proc/{pid}. Critically, there was no input sanitization on the pid parameter before constructing the path. An unauthenticated user could supply a path traversal payload:
GET /API/process/checkPidStatus.php?pid=/../etc/passwd HTTP/1.1
Host: <expedition-ip>If the specified path exists on the filesystem, the response returns {"isRunning": true}. If it doesn’t exist, it returns {"isRunning": false}.
This is a boolean information disclosure vulnerability: an unauthenticated attacker can check for the existence of any file on the Expedition VM’s filesystem. While this doesn’t directly disclose file contents, it enables an attacker to:
- Confirm the presence of sensitive configuration files
- Map the filesystem structure
- Identify files of interest for exploitation (SSH keys, credential files, backup configurations)
- Determine OS version and installed packages by testing for known file paths
Proof of Concept
Test for an existing file:
curl "https://<expedition-ip>/API/process/checkPidStatus.php?pid=/../etc/passwd"
# Response: {"isRunning":true}Test for a non-existent file:
curl "https://<expedition-ip>/API/process/checkPidStatus.php?pid=/../etc/shadow_backup"
# Response: {"isRunning":false}Disclosure Timeline
- 2018-10-17: CyberOne discloses vulnerability to Palo Alto Networks PSIRT
- 2018-10-17: Palo Alto Networks confirms receipt and validates the vulnerability
- 2018-11-20: Palo Alto Networks informs CyberOne the vulnerability is fixed and issues CVE-2018-10142
- 2018-12-03: Public disclosure by CyberOne’s Quentin Rhoads-Herrera
Remediation
Palo Alto Networks patched Expedition to sanitize the pid input parameter, removing the path traversal vector. The fix was delivered in an Expedition update. Organizations running Expedition should ensure they are running a version released after November 2018.
More broadly, this vulnerability class — unsanitized path components passed to filesystem operations — remains a common finding in web application assessments. The correct remediation approach is input validation that rejects path traversal sequences (../, URL-encoded variants %2e%2e%2f) before any filesystem operation, combined with operating as a least-privileged user that has read access only to the specific directories the function legitimately needs.
Expedition in 2026
Palo Alto Networks has continued developing Expedition, and subsequent versions have addressed additional security issues identified by Palo Alto’s internal teams and external researchers. Organizations using Expedition as part of their migration or policy optimization workflow should ensure they are running the current version and that the Expedition VM is isolated from untrusted networks — it should not be internet-accessible, and access should be restricted to authorized administrators.
CyberOne’s offensive security team conducts security assessments of network security infrastructure including migration tools and management platforms as part of application security assessments for organizations that manage their own firewall policy lifecycle.