GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

cancel
Showing results for 
Search instead for 
Did you mean: 

GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

L2 Linker

Has anyone scanned their GlobalProtect Portals/Gateways with a Qualys WAS scanner?  With GP running version 10.0.x, it's reporting back QID 150307 External Service interaction via Host Header Injection.  

 

The scanner injects a special FQDN in the Host header and X-Forwarded-Host header. Qualys Periscope is used to detect any subsequent DNS request and identify the presence of the vulnerability.
Impact
Attackers can potentially redirect users to unintended servers under the attacker's control. Other possible consequences include altered control flow, arbitrary control of a resource, arbitrary code execution. XSS, access to internal hosts, web cache poisoning, or HTML injection.
Solution

3 REPLIES 3

L0 Member

Yes, we just enrolled in continuous vulnerability scanning and this is one of their findings for us as well.

L0 Member

Same question here.

L0 Member

Palo Alto and feedback?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!