topic Re: frame_ancestors_missing in General Topics

frame_ancestors_missing

DinoAdami — Mon, 08 Apr 2024 14:48:19 GMT

Hi
I run a regular scan on our equipment from a public source and I am seeing the following vuln being flagged against the URL that is used for our Palo devices and I was hoping someone would have an answer as there's not much information out there.

The Analysis refers to:

Site Does Not Use Best Practices Against Embedding of Malicious Content

The host header ; frame_ancestors_missing

Hoping someone can advise
Many thanks

Re: frame_ancestors_missing

BPry — Mon, 08 Apr 2024 20:36:13 GMT

@DinoAdami,

frame-ancestors are served up in the CSP header and essentially just limit the ability to embed a page to whatever you have specified. Whatever you're using for scanning is properly reporting that this isn't present for GlobalProtect; I'm unaware of any ability to customize this behavior. You can reach out to your SE to get a FR put together to add this functionality however.

Re: frame_ancestors_missing

DinoAdami — Tue, 09 Apr 2024 08:22:16 GMT

@BPry

Thank you for this, I received a response from our support partner early this morning and their response is along the same lines. Do you know of any official Palo documentation that advises as such, I'm unable to find anything that outlines this behaviour - I can go back to the online scanner; SecurityScorecard.io to have this false positive removed.

Many thanks

Re: frame_ancestors_missing

BPry — Tue, 09 Apr 2024 13:36:37 GMT

@DinoAdami,

I'm not aware of any official documentation specifically stating that frame-ancestors isn't supported; that's kind of asking for documentation to support the lack of a specific functionality, it isn't extremely common that a vendor will take the time to publish that information.

I also want to be clear here that this isn't really a false-positive detection. Your scanner is properly documenting the lack of a specific functionality that would make things more secure if it was utilized, the product that it's scanning simply doesn't support said functionality.

Re: frame_ancestors_missing

AveryHawkins — Mon, 20 May 2024 08:20:15 GMT

Thank you so much for the solution. You made my day. I wasn't expecting that I am gonna find your post. I was actually searching for this https://academized.com/custom-thesis website online because my younger brother needs custom thesis writing help and when I was searching for it online, I found link to your post as well.