CVE-2021-44790 & CVE-2021-44224

ChandraAlem — Tue, 28 Dec 2021 04:12:31 GMT

Hi All

we are using Paloalto firewall 3060 with OS version 8.1.7

is there any updated info regarding this vulnerability CVE-2021-44790 & CVE-2021-44224? Has Paloalto found a way to mitigate this vulnerability?

Please advise

Re: CVE-2021-44790 & CVE-2021-44224

gorantomte — Tue, 28 Dec 2021 06:38:15 GMT

Hi there

I would do the following:

- for your inbound rule, from internet to DMZ and your webserver on App-ID ssl, or web-browsing if you’re doing ssl decryption, I would add URL as a match criteria. Add a custom URL category containing the FQDN based URLs for you website. domain.com/ and *.domain.com/. This will prevent the scanners from abusing your website by purely using IP. With CVE-2021-44228 we’ve seen IP based scans, and this config would stop successful scans

- SSL Inbound Inspection. Use it for all your services, including for the internal services. By doing this you gain full visibility, for App-ID, and for IoC signatures. You are also then able to add even more granular URLs in your custom category in the match criteria

- I haven’t found details on how and what body headers needs to be modified to abuse this vulnerability, but the SSL decryption will make it possible to read these headers when the IPS signatures are to be available.

Re: CVE-2021-44790 & CVE-2021-44224

marxcaro — Tue, 15 Feb 2022 05:11:40 GMT

thanks for your helpful response. All questions answered

slope game

topic Re: CVE-2021-44790 & CVE-2021-44224 in Advanced Threat Prevention Discussions

CVE-2021-44790 & CVE-2021-44224

Re: CVE-2021-44790 & CVE-2021-44224

Re: CVE-2021-44790 & CVE-2021-44224