Qualys scan vulnerability qid 150004 FortiOS 6.4.15

[dmccutcheon]

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ file

RESULT:
url: https://x.x.x.x/images/
Payload: https://x.x.x.x/images/
comment:
Original URL is: https://x.x.x.x/
matched: HTTP/1.1 200 OK

I have SSL VPN in tunnel only mode, web mode disabled 

I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-porta... to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. 

Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.

I've searched forums, google etc but not coming across any similar issues.

[pminarik · Accepted solution]

This looks like a false positive.

When you send a GET request to https://<your vpn>:<port>/images, the FortiGate seems to respond with a javascript-based redirect to /remote/login (the actual login URL).

Based on a quick reading (feel free to contest this!), the signature QID150004 deals with discovering otherwise-hidden resources via predictable/easy-to-guess paths (such as /images/). In this case, we can clearly see that there's nothing hiding at /images/, it's just a redirect to the regular login. 

[dmccutcheon]

The ASV scanning vendor has marked this as a false positive.