Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Access Palo Alto HTML Files

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Access Palo Alto HTML Files

L3 Networker

Hello, our user want to deploy Palo Alto Firewall 3410 with Os 10.2.2, for security reason then they do the vulnerability assessment but using different device but with same OS 10.2.2.

 

And the result is that they found 2 vulnerabilityissues, low and information.

i took this VA is on the login page on palo alto firewall.

The Low vulnerabilityis about 'autocomplete' attribute is not disabled on password fields.

and the Information vulnerabilityis about robots.txt, that they recommed to limit that access to that file.

 

what i want to ask, is that possible to edit the html files for fix this low vulnerability?

is there any docs so i can fix this vulnerability?

1 accepted solution

Accepted Solutions

Since i didn't find any docs about how to edit base html files on PanOS/mitigate this problem, so I just open ticket in support portal.

And they do the checking on html files. 

the result for the low vulnerability is It seems false positive if the scanner is detecting it. The browsers can save the password regardless of the autocomplete ='off' and  o be the scanners.

and for the information vulnerability with robot.txt is The contents of the robots.txt does not reveal any information about the secret path directories. This hints to disallow everything from the root '/', so no specific directories to allow or disallow.

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello there. 

The Live Community are volunteers and end users of the product, who come together to assist others.
I have not heard of any way to modify the "base" html files on the PANOS.
You would need to submit a feature request through your local PANW SE.
That is the correct process to follow.

Help the community: Like helpful comments and mark solutions

Since i didn't find any docs about how to edit base html files on PanOS/mitigate this problem, so I just open ticket in support portal.

And they do the checking on html files. 

the result for the low vulnerability is It seems false positive if the scanner is detecting it. The browsers can save the password regardless of the autocomplete ='off' and  o be the scanners.

and for the information vulnerability with robot.txt is The contents of the robots.txt does not reveal any information about the secret path directories. This hints to disallow everything from the root '/', so no specific directories to allow or disallow.

L1 Bithead

Replying back to this several years late but I do have a fix. Enabling the requirement to force users to accept the banner on login seems to bypass this being reported as a vulnerability. I have successfully verified this across 8.1, 9.1, and 10.1 across 7 devices.

Thanks for that information 🙂

L0 Member

This is appears to be fixed in least 10.2.8, you dont even need to login to the device to confirm, inspect the html on the pages the auditors are complaining about:

 

The portal login form has autocomplete=off set on the form tag on line 265

The admin login has autocomplete=off set on the form tag on line 27

 

According to Tenable(Nessus) having autocomplete set to off on the form is the preferred option

https://www.tenable.com/plugins/was/98081

 

I figured id post this since this was the only thing i found on the internet talking about this nonsense "issue", its a false positive. Maybe next year when it comes up for my audit ill find this post again.

 

  • 1 accepted solution
  • 4853 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!