GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

[jmurphy]

Has anyone scanned their GlobalProtect Portals/Gateways with a Qualys WAS scanner?  With GP running version 10.0.x, it's reporting back QID 150307 External Service interaction via Host Header Injection.  

The scanner injects a special FQDN in the Host header and X-Forwarded-Host header. Qualys Periscope is used to detect any subsequent DNS request and identify the presence of the vulnerability.
Impact
Attackers can potentially redirect users to unintended servers under the attacker's control. Other possible consequences include altered control flow, arbitrary control of a resource, arbitrary code execution. XSS, access to internal hosts, web cache poisoning, or HTML injection.
Solution

[jstein]

Yes, we just enrolled in continuous vulnerability scanning and this is one of their findings for us as well.

[Flaster135]

Same question here.

[jstein]

Palo Alto and feedback?

[bburstein]

Was there ever any resolution to this?

[Benzito]

I know this is several months old, but was there ever a resolution for this?

[jstein]

Not that I have seen.

[Benzito]

Hello, was there an update or fix for this?

[DaBone]

Palo Alto PSIRT looked into this and determined it is a false positive.