Cross-Site Scripting (Expect Header) Fortiweb 2.2.0

Eric_Robinson · ‎06-26-2012

Hello, We have hired a security company to perform a penetration test. One of the tests they performed reported a risk. Here is the test parameters: Using: ncat --ssl (our static IP) 443 GET / HTTP/1.1 HOST:(our static IP) EXPECT:" ><script>alert(' XSS' )</script> The response (given below - I assume by the Fortigate) HTTP/1.1 417 Expectation Failed Date: Tue, 15 May 2012 18:58:45 GMT Server: FortiWeb-2.2.0 Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 174 <!DOCTYPE HTML PUBLIC " -//IETF//DTD HTML 2.0//EN" > <html><head> <title>417 Expectation Failed</title> </head><body> <h1>Expectation Failed</h1> The expectation given in the Expect request-header field could not be met by this server.<p> The client sent<pre> Expect: " ><script>alert(' XSS' )</script> </pre> but we only allow the 100-continue expectation. </body></html> What I am wondering is what I must do to change the response by the Fortigate so that the security tester does not believe that we are vulnerable to cross site scripting.

Idan_Soen_FTNT · ‎06-27-2012

We need more information. Are they pen testing a FortiWeb or FortiGate (you have posted to a FortiWeb forum, not FortiGate)?

Eric_Robinson · ‎06-27-2012

Hello, They are pen testing a: Model: Fortigate-60 Running: Firmware: Fortigate-60 2.50,build171,031215 And it appears that one of the items in the response from the Fotigate 60 is: Server: FortiWeb-2.2.0 So I was assuming that Fortiweb was running on the Fortigate 60. We do not have any other Fortinet appliances on the network and there are not any Fortiweb applications or services installed or running on the servers behind the Fortigate60. Any insight is appreciated. Thanks for your help.

Idan_Soen_FTNT · ‎06-27-2012

You need to post this question to the FortiGate forum. This is the FortiWeb forum

Eric_Robinson · ‎06-27-2012

OK. Thanks, I will post this topic in the Fortigate forum.