Exception Handling in Palo Alto Support Page 7/22/2021

[EdwardDaga]

Hello Palo Alto Team,

I would like to bring this up with you.

I noticed that your support page went down today 7/22/2021 and that is fine. What worries me is the way your system handles exception. I think you are exposing to much that end user like myself has no business reading.

1. No connection could be made because the target machine actively refused it 10.142.69.9:3306

Here you are exposing the private IP of your internal server and the port that it is listening to.

2. [MySqlException (0x80004005): Unable to connect to any of the specified MySQL hosts.]

You are exposing to the Internet that you are using MySQL

3. Csp.Infrastructure.Data.Persistence.Configuration.SessionSourceConfiguration.CreateSessionSource(PersistenceModel model) in C:\JenkinsWorkspace\CSP-GCP\CustomerSupportPortal\Csp.Infrastructure.Data\Persistence\Configuration\SessionSourceConfiguration.cs:36
Csp.Infrastructure.Data.Persistence.Configuration.SessionSourceConfiguration..ctor(IApplicationSettings applicationSettings, IConnectionStrings connectionStrings, IPreInsertEventListener preInsertEventListener, IPreUpdateEventListener preUpdateEventListener) in C:\JenkinsWorkspace\CSP-GCP\CustomerSupportPortal\Csp.Infrastructure.Data\Persistence\Configuration\SessionSourceConfiguration.cs:18
lambda_method(Closure , Object[] ) +134

And third you are exposing directories.

I am no web developer myself but I felt that this information are too much for most users of your support page. This could expose you to bad actors that knows what they're doing. Let's make it hard for them!....

Sincerely,

Edward T. Daga CISSP, PCNSE, CCNP

[jdelio]

Thank you so much for your feedback on the Support Site outage. 

I am forwarding this to them to ensure that we are limiting any exposure of this information to the general public. 

Thanks again, and this is just part of the feedback we love to hear from you.