topic Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection in GlobalProtect Discussions

GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

jmurphy — Tue, 07 Sep 2021 17:32:09 GMT

Has anyone scanned their GlobalProtect Portals/Gateways with a Qualys WAS scanner? With GP running version 10.0.x, it's reporting back QID 150307 External Service interaction via Host Header Injection.

The scanner injects a special FQDN in the Host header and X-Forwarded-Host header. Qualys Periscope is used to detect any subsequent DNS request and identify the presence of the vulnerability.
Impact
Attackers can potentially redirect users to unintended servers under the attacker's control. Other possible consequences include altered control flow, arbitrary control of a resource, arbitrary code execution. XSS, access to internal hosts, web cache poisoning, or HTML injection.
Solution

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

jstein — Tue, 02 Nov 2021 16:34:15 GMT

Yes, we just enrolled in continuous vulnerability scanning and this is one of their findings for us as well.

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

Flaster135 — Tue, 02 Nov 2021 18:10:07 GMT

Same question here.

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

jstein — Tue, 14 Jun 2022 22:37:21 GMT

Palo Alto and feedback?

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

bburstein — Tue, 23 Aug 2022 13:15:02 GMT

Was there ever any resolution to this?

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

Benzito — Wed, 01 Mar 2023 17:29:32 GMT

I know this is several months old, but was there ever a resolution for this?

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

jstein — Wed, 01 Mar 2023 17:30:57 GMT

Not that I have seen.

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

Benzito — Tue, 04 Apr 2023 00:30:44 GMT

Hello, was there an update or fix for this?

Re: GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

DaBone — Fri, 21 Apr 2023 15:37:48 GMT

Palo Alto PSIRT looked into this and determined it is a false positive.