Qualys scan vulnerability qid 150004 FortiOS 6.4.15

[dmccutcheon]

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ file

RESULT:
url: https://x.x.x.x/images/
Payload: https://x.x.x.x/images/
comment:
Original URL is: https://x.x.x.x/
matched: HTTP/1.1 200 OK

I have SSL VPN in tunnel only mode, web mode disabled 

I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-porta... to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. 

Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.

I've searched forums, google etc but not coming across any similar issues.

[pminarik · Accepted solution]

This looks like a false positive.

When you send a GET request to https://<your vpn>:<port>/images, the FortiGate seems to respond with a javascript-based redirect to /remote/login (the actual login URL).

Based on a quick reading (feel free to contest this!), the signature QID150004 deals with discovering otherwise-hidden resources via predictable/easy-to-guess paths (such as /images/). In this case, we can clearly see that there's nothing hiding at /images/, it's just a redirect to the regular login. 

[dmccutcheon]

sorry i'm on 6.4.15 

[AnthonyH]

Hello dmccutcheon,

Even if the webmode is set to disable, the tunnel mode and webmode will be listening on the same port and this site: https://<public_ip>:sslvpn_port will show up in the scans. Are you able to migrate over to IPSec dialup VPN?

[dmccutcheon]

Hi Anthony, 

No IPsec dialup isnt viable not all my devices support it. It seems to be specific to the /images/  folder, which when i put in the browser took me to the web signin page after a re-direct, when i applied the "removing the html body" in the html replacement i only get a white screen (which is expected) but Qualys still fails it.

I'm assuming something has changed at the Qualys end & have contacted the supplier. 

I'll probably apply for an PCI exclusion for this but they do need some technical justification.

[HarshChavda]

Hello @dmccutcheon ,

Can you try  URL filtering rules to block access to the directory and apply it to the policy.

[dmccutcheon]

Hi Harsh

That approach would defeat the purpose of the ASV, under PCI were not supposed to block or hinder the scanning tool

[Toshi_Esumi]

I searched for this as well. But it seems to happen only with Quarlys. I haven't heard any customers who use SSL VPN tunnel mode and get annual PCI audits got this "predictable resource location" flagged and failed because of it. I don't think anybody in our customers use Quarlys.
Most of customers run 7.0.x though. But I don't think that would make any difference from 6.4.x because I assume the image file folder hasn't moved.

Toshi 

[dmccutcheon]

Hi Toshi, this happened at the start of July when our monthly ASV scans  failed, it had been working perfectly well until that point on 6.4.15

The ASV scanning vendor are pretty useless when it comes to the actual mechanics of Qualys ASV scans

I guess the next step is a fortinet tech case as the ASV vendor needs to see proof that its not exploitable

[pminarik · Accepted solution]

This looks like a false positive.

When you send a GET request to https://<your vpn>:<port>/images, the FortiGate seems to respond with a javascript-based redirect to /remote/login (the actual login URL).

Based on a quick reading (feel free to contest this!), the signature QID150004 deals with discovering otherwise-hidden resources via predictable/easy-to-guess paths (such as /images/). In this case, we can clearly see that there's nothing hiding at /images/, it's just a redirect to the regular login. 

[dmccutcheon · Accepted solution]

Hi pminarik, think you've saved me a tac case, i concur with your findings , i could see the redirect but wondered why qualys didnt follow it.

I was struggling to discover if the qualys output should list the actual files in the /images/ folder but all it returns is a 200Ok which i assume means qualys found a "predictable" folder regardless of content

thanks & i'll apply for a false positive excemption.