CVE-2021-44790 & CVE-2021-44224

[ChandraAlem]

Hi All

we are using Paloalto firewall 3060 with OS version 8.1.7

is there any updated info regarding this vulnerability CVE-2021-44790 & CVE-2021-44224? Has Paloalto found a way to mitigate this vulnerability?

Please advise

[gorantomte]

Hi there

I would do the following:

- for your inbound rule, from internet to DMZ and your webserver on App-ID ssl, or web-browsing if you’re doing ssl decryption, I would add URL as a match criteria. Add a custom URL category containing the FQDN based URLs for you website. domain.com/ and *.domain.com/. This will prevent the scanners from abusing your website by purely using IP. With CVE-2021-44228 we’ve seen IP based scans, and this config would stop successful scans

- SSL Inbound Inspection. Use it for all your services, including for the internal services. By doing this you gain full visibility, for App-ID, and for IoC signatures. You are also then able to add even more granular URLs in your custom category in the match criteria

- I haven’t found details on how and what body headers needs to be modified to abuse this vulnerability, but the SSL decryption will make it possible to read these headers when the IPS signatures are to be available. 

GT

[marxcaro]

thanks for your helpful response. All questions answered

slope game