we are using Paloalto firewall 3060 with OS version 8.1.7
is there any updated info regarding this vulnerability CVE-2021-44790 & CVE-2021-44224? Has Paloalto found a way to mitigate this vulnerability?
I would do the following:
- for your inbound rule, from internet to DMZ and your webserver on App-ID ssl, or web-browsing if you’re doing ssl decryption, I would add URL as a match criteria. Add a custom URL category containing the FQDN based URLs for you website. domain.com/ and *.domain.com/. This will prevent the scanners from abusing your website by purely using IP. With CVE-2021-44228 we’ve seen IP based scans, and this config would stop successful scans
- SSL Inbound Inspection. Use it for all your services, including for the internal services. By doing this you gain full visibility, for App-ID, and for IoC signatures. You are also then able to add even more granular URLs in your custom category in the match criteria
- I haven’t found details on how and what body headers needs to be modified to abuse this vulnerability, but the SSL decryption will make it possible to read these headers when the IPS signatures are to be available.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!