A vulnerability "HSTS Missing From HTTPS Server" is reported on Panorama on port TCP/28443

3125

Created On 01/14/23 02:10 AM - Last Modified 08/22/24 22:26 PM

Vulnerability Assessment

Threat Intelligence

Threat Prevention

10.0

10.2

10.1

11.1

11.0

Panorama

Symptom

When scanning Panorama for vulnerabilities on port TCP/28443, a vulnerability is reported.
Example below:

The remote HTTPS server does not send the HTTP Strict-Transport-Security header

HSTS Missing From HTTPS Server

Port TCP/28443 is used only for downloading content files from the Panorama by the firewalls and thus it is not a general access channel.
It's not possible to connect to the port without a client certificate signed by the built-in CA certificate of the Panorama.
For example, when we try to connect the port with a scanner tool such as Nessus, a connection error happens and the HSTS (HTTP Strict Transport Security) header is not coming as part of the error output.
As a result, the scanner tool flags it as a vulnerability.

This is not a Vulnerability.
If we connect the port with the right client certificate, the strict header is seen correctly.

PAN-OS Software Updates