Check and help resolving VAPT reported issues Global Protect SSL VPN Url

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Check and help resolving VAPT reported issues Global Protect SSL VPN Url

L2 Linker

We have done VAPT on our Global protect URL link and identified 3 VA,
Kindly check and help resolving this at earliest.

1) Absence of CSRF tokens :-

No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.


2) Missing secure Flag Attributes in the Encrypted Session (SSL) Cookie:-

The Session Cookie Does Not Have "Secure" Attribute.The Secure Attribute Tells The Browser To Only Use This Cookie Via Secure/Encrypted Connections. This measure makes certain client-side attacks, such as cross-site scripting, slightly harder to exploit by preventing them from trivially capturing the cookie's value via an injected script.

3) Referrer-Policy Header is not implemented:-

It was observed that, Referrer-policy is not implemented in response header.
Referrer-Policy is a security header designed to prevent cross-domain referrer leakage.

Also, VAPT team has provided following links for 3 vulnerabilities






1 accepted solution

Accepted Solutions

L7 Applicator

Please open a case with Support.

View solution in original post


L7 Applicator

Please open a case with Support.

@Pankaj  Did you find any answers on the question you had raised here ?  our VAPT team raised the same concerns 

  • 1 accepted solution
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!