New Member

Solved

Qualys scan vulnerability qid 150004 FortiOS 6.4.15

Forum|Forum|2 years ago
July 29, 2024
10 replies
6384 views

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ file

RESULT:
url: https://x.x.x.x/images/
Payload: https://x.x.x.x/images/
comment:
Original URL is: https://x.x.x.x/
matched: HTTP/1.1 200 OK

I have SSL VPN in tunnel only mode, web mode disabled

I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-portal-from/ta-p/215905 to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem.

Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.

I've searched forums, google etc but not coming across any similar issues.

FortiGate

Best answer by dmccutcheon

Hi pminarik, think you've saved me a tac case, i concur with your findings , i could see the redirect but wondered why qualys didnt follow it.

I was struggling to discover if the qualys output should list the actual files in the /images/ folder but all it returns is a 200Ok which i assume means qualys found a "predictable" folder regardless of content

thanks & i'll apply for a false positive excemption.

dmccutcheonAuthor

New Member

sorry i'm on 6.4.15

AnthonyH

Staff

Hello dmccutcheon,

Even if the webmode is set to disable, the tunnel mode and webmode will be listening on the same port and this site: https://<public_ip>:sslvpn_port will show up in the scans. Are you able to migrate over to IPSec dialup VPN?

dmccutcheonAuthor

New Member

Hi Anthony,

No IPsec dialup isnt viable not all my devices support it. It seems to be specific to the /images/ folder, which when i put in the browser took me to the web signin page after a re-direct, when i applied the "removing the html body" in the html replacement i only get a white screen (which is expected) but Qualys still fails it.

I'm assuming something has changed at the Qualys end & have contacted the supplier.

I'll probably apply for an PCI exclusion for this but they do need some technical justification.

HarshChavda

Staff

Hello @dmccutcheon ,

Can you try URL filtering rules to block access to the directory and apply it to the policy.

dmccutcheonAuthor

New Member

Hi Harsh

That approach would defeat the purpose of the ASV, under PCI were not supposed to block or hinder the scanning tool

Toshi_Esumi

SuperUser

I searched for this as well. But it seems to happen only with Quarlys. I haven't heard any customers who use SSL VPN tunnel mode and get annual PCI audits got this "predictable resource location" flagged and failed because of it. I don't think anybody in our customers use Quarlys.
Most of customers run 7.0.x though. But I don't think that would make any difference from 6.4.x because I assume the image file folder hasn't moved.

Toshi

dmccutcheonAuthor

New Member

Hi Toshi, this happened at the start of July when our monthly ASV scans failed, it had been working perfectly well until that point on 6.4.15

The ASV scanning vendor are pretty useless when it comes to the actual mechanics of Qualys ASV scans

I guess the next step is a fortinet tech case as the ASV vendor needs to see proof that its not exploitable

pminarik

Staff

This looks like a false positive.

When you send a GET request to https://<your vpn>:<port>/images, the FortiGate seems to respond with a javascript-based redirect to /remote/login (the actual login URL).

Based on a quick reading (feel free to contest this!), the signature QID150004 deals with discovering otherwise-hidden resources via predictable/easy-to-guess paths (such as /images/). In this case, we can clearly see that there's nothing hiding at /images/, it's just a redirect to the regular login.

dmccutcheonAuthorAnswer

New Member

Hi pminarik, think you've saved me a tac case, i concur with your findings , i could see the redirect but wondered why qualys didnt follow it.

I was struggling to discover if the qualys output should list the actual files in the /images/ folder but all it returns is a 200Ok which i assume means qualys found a "predictable" folder regardless of content

thanks & i'll apply for a false positive excemption.

dmccutcheonAuthor

New Member

The ASV scanning vendor has marked this as a false positive.

Sign up

Login with SSO

Login to the community

Login with SSO