High vulnerabilities PAN-OS reported by vulnerability management scan

Metgatz — Thu, 25 Aug 2022 22:53:31 GMT

Hello colleagues:

Good afternoon, hope you are all well.

Some of you have reported these critical vulnerabilities to them, by Nesus Scan:

Protocol	Port	Name	Synopsis	Description	Solution
TCP	443	CGI Generic Command Execution (time-based)	It may be possible to run arbitrary code on the remote web server.	The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. Note that this script uses a time-based detection method which is less reliable than the basic method.	Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.
TCP	443	CGI Generic SQL Injection (blind, time based)	A CGI application hosted on the remote web server is potentially prone to SQL injection attack.	By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database. An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system. Note that this script is experimental and may be prone to false positives.	Modify the affected CGI scripts so that they properly escape arguments.

Do you know if these two are false positives, if they can be mitigated with an adjustment or by performing an upgrade?

This was reported on PAN-OS 9.1.4 platform.

I remain attentive to your comments and suggestions

Thanks

Best regards

Re: High vulnerabilities PAN-OS reported by vulnerability management scan

OtakarKlier — Mon, 29 Aug 2022 19:28:24 GMT

Hello,

I would recommend you upgrade the code version.

Regards,