GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

Showing results for 
Show  only  | Search instead for 
Did you mean: 

GlobalProtect Qualys: 150307 External Service interaction via Host Header Injection

L2 Linker

Has anyone scanned their GlobalProtect Portals/Gateways with a Qualys WAS scanner?  With GP running version 10.0.x, it's reporting back QID 150307 External Service interaction via Host Header Injection.  


The scanner injects a special FQDN in the Host header and X-Forwarded-Host header. Qualys Periscope is used to detect any subsequent DNS request and identify the presence of the vulnerability.
Attackers can potentially redirect users to unintended servers under the attacker's control. Other possible consequences include altered control flow, arbitrary control of a resource, arbitrary code execution. XSS, access to internal hosts, web cache poisoning, or HTML injection.


L1 Bithead

Yes, we just enrolled in continuous vulnerability scanning and this is one of their findings for us as well.

L0 Member

Same question here.

L1 Bithead

Palo Alto and feedback?

L0 Member

Was there ever any resolution to this?

L1 Bithead

I know this is several months old, but was there ever a resolution for this?

Not that I have seen.

L1 Bithead

Hello, was there an update or fix for this?

L4 Transporter

Palo Alto PSIRT looked into this and determined it is a false positive.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!