09-07-2021 10:32 AM
Has anyone scanned their GlobalProtect Portals/Gateways with a Qualys WAS scanner? With GP running version 10.0.x, it's reporting back QID 150307 External Service interaction via Host Header Injection.
The scanner injects a special FQDN in the Host header and X-Forwarded-Host header. Qualys Periscope is used to detect any subsequent DNS request and identify the presence of the vulnerability.
Impact
Attackers can potentially redirect users to unintended servers under the attacker's control. Other possible consequences include altered control flow, arbitrary control of a resource, arbitrary code execution. XSS, access to internal hosts, web cache poisoning, or HTML injection.
Solution
