frame_ancestors_missing

[DinoAdami]

Hi 
I run a regular scan on our equipment from a public source and I am seeing the following vuln being flagged against the URL that is used for our Palo devices and I was hoping someone would have an answer as there's not much information out there.

The Analysis refers to: 

Site Does Not Use Best Practices Against Embedding of Malicious Content

The host header ; frame_ancestors_missing 

Hoping someone can advise 
Many thanks

D

[BPry · Accepted solution]

@DinoAdami,

frame-ancestors are served up in the CSP header and essentially just limit the ability to embed a page to whatever you have specified. Whatever you're using for scanning is properly reporting that this isn't present for GlobalProtect; I'm unaware of any ability to customize this behavior. You can reach out to your SE to get a FR put together to add this functionality however.

[DinoAdami]

@BPry 

Thank you for this, I received a response from our support partner early this morning and their response is along the same lines. Do you know of any official Palo documentation that advises as such, I'm unable to find anything that outlines this behaviour - I can go back to the online scanner; SecurityScorecard.io to have this false positive removed.

Many thanks

[BPry]

@DinoAdami,

I'm not aware of any official documentation specifically stating that frame-ancestors isn't supported; that's kind of asking for documentation to support the lack of a specific functionality, it isn't extremely common that a vendor will take the time to publish that information.

I also want to be clear here that this isn't really a false-positive detection. Your scanner is properly documenting the lack of a specific functionality that would make things more secure if it was utilized, the product that it's scanning simply doesn't support said functionality.