Rover caught an interesting request in Siren telemetry:
GET /unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css HTTP/1.1
Host: [sensor]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
This is the public exploit path for CVE-2025-0108, an authentication bypass in the Palo Alto Networks PAN-OS management web interface. The giveaway is the combination of a double-encoded traversal, a PAN-OS PHP endpoint, and a static-looking CSS suffix:
/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css
Palo Alto Networks rates the vulnerability High at CVSS 8.8 and marks it as attacked. CISA added it to the Known Exploited Vulnerabilities catalog in February 2025. The request Rover found is a clean example of what that exploitation looks like on the wire.
The raw request captured by Siren. The sensor hostname is masked.
There is no bulky payload here. The entire attack lives in the URL. Here is why it works.
The Request
Siren recorded the same request twice. Strip away the ordinary browser headers and three pieces remain:
/unauth/tells the front-end proxy that the route does not require authentication.%252e%252eis..encoded twice. The first decoding pass produces%2e%2e; the next produces the traversal sequence./php/ztp_gate.php/PAN_help/x.csspoints at a PAN-OS PHP script but ends like a static asset, which is exactly what triggers the Apache rewrite path.
Each fragment has a job. Put them together and the request crosses an authentication boundary.
The Vulnerability
The PAN-OS management web interface places Nginx in front of Apache and PHP. That is a common architecture: one server handles routing and access checks, while another serves the application. CVE-2025-0108 appears when those layers disagree about what the path means.
The incoming path is:
/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css
Nginx decodes it once:
/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css
At this stage there is no literal .., so Nginx still sees a path under /unauth/. It switches the PAN-OS authentication check off and sends the original request to Apache.
Apache decodes the path, sees the .css request below /PAN_help/, and applies a rewrite that adds .gz. That rewrite creates an internal redirect, so Apache processes the URL again. On the next pass, %2e%2e becomes ..:
/unauth/../php/ztp_gate.php/PAN_help/x.css.gz
Path normalization removes /unauth/../, leaving:
/php/ztp_gate.php/PAN_help/x.css.gz
Apache hands the request to PHP, but the authentication decision has already been made by Nginx using the earlier version of the path. The PHP script runs with the authentication check disabled.
That is the bug: Nginx authorizes one representation of the URL, and Apache executes another.
Why the Fake CSS File Matters
The x.css suffix is not decoration. PAN-OS includes an Apache rewrite rule for CSS, JavaScript, and HTML files beneath /PAN_help/. The rule adds the gzip suffix and triggers the internal redirect that gives the traversal its second decoding pass.
So the request is doing two things at once:
- It convinces Nginx that it belongs to an unauthenticated route.
- It convinces Apache to process the path again until the encoded traversal becomes real.
Authentication in front of a proxy chain is only as strong as the path interpretation shared by every layer behind it.
Detecting the Exploit
Keep the raw request target. If a proxy decodes the URL before logging it, the %252e%252e sequence that makes this probe stand out may disappear.
A direct match for the observed path is:
(?i)/unauth/%252e%252e/php/ztp_gate\.php/PAN_help/.*\.(?:css|js|html?|htm)
Also hunt for:
%252e%252ebelow/unauth/;- requests that combine
/php/and/PAN_help/in the same path; - successful responses to unauthenticated management PHP routes; and
- follow-on probes for CVE-2024-9474 or CVE-2025-0111 from the same source.
Match on the path, not the Firefox user-agent. Scanners change headers cheaply; the exploit still needs the same parsing behavior.
Patch the Management Interface
Palo Alto Networks lists the following fixed releases:
- PAN-OS 10.1: 10.1.14-h9 or later
- PAN-OS 10.2: 10.2.13-h3 or a fixed hotfix listed for the relevant maintenance release
- PAN-OS 11.1: 11.1.6-h1 or a fixed hotfix for 11.1.2 or 11.1.4
- PAN-OS 11.2: 11.2.4-h4, 11.2.5, or later
- PAN-OS 11.0 and older EOL releases: move to a supported fixed release
Restrict the management interface to trusted internal addresses or a jump host even after patching. Customers with a Threat Prevention subscription can enable Threat IDs 510000 and 510001, introduced in Applications and Threats content version 8943.
Cloud NGFW and Prisma Access are not affected according to the vendor.
One URL, Two Interpretations
CVE-2025-0108 is a small request with an unusual trip through the stack. Nginx sees an unauthenticated static path. Apache sees a traversal into a PHP script. The attacker gets the benefit of both interpretations.
Siren caught the request. Rover pulled it out of the background noise. We will keep watching for changes to the path and for the follow-on vulnerabilities Palo Alto Networks has already seen chained with it.
