HTTP OPTIONS Method Enabled on Panorama

[Teddy_Teddy]

Hi All,

I got Vulnerability HTTP OPTIONS Method Enabled on Panorama, the status show OK.

curl -k -v -X OPTIONS -x "" https://10.10.10.10/restapi

* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Wed, 27 Apr 2022 02:47:02 GMT
< Content-Type: httpd/unix-directory
< Content-Length: 0
< Connection: keep-alive
< Allow: OPTIONS,GET,HEAD,POST,TRACE
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block;
< X-Content-Type-Options: nosniff
< Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;

But in the gateway Palo Alto its show Bad request.

curl -k -v -X OPTIONS -x "" https://10.10.10.11/restapi

* schannel: server closed the connection
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Date: Wed, 27 Apr 2022 02:48:26 GMT
< Content-Type: text/html
< Content-Length: 1174
< Connection: close

Any idea?

[Teddy_Teddy · Accepted solution]

Hi,

how can I block HTTP method OPTIONS in Panorama? is it possible?