A Qualys scan claims the the Web Gateway is vulnerable when the proxy is enabled.

Products

• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

When scanning the Secure Web Gateway (SWG) with the proxy function enabled, Qualys scans may flag a vulnerability reporting QID 62026 and QID 62035 regarding the HTTP CONNECT method.

Cause

Qualys flags this behavior as a security risk because an unsecure or exposed CONNECT method can potentially be exploited as an open or reverse proxy, allowing external traffic to traverse your internal network.

However, within a standard Secure Web Gateway deployment, the CONNECT method is a technical requirement for the proxy to establish and support HTTPS connections.

Resolution

To mitigate this risk and resolve the scan findings, implement one or both of the following remediation strategies:

Option 1: Restrict External Network Access (Recommended)

Ensure that a perimeter firewall is deployed upstream of the Web Gateway. Configure firewall rules to block all inbound traffic originating from the Internet targeted at the Web Gateway's proxy port. This prevents external entities from abusing the proxy function.

Option 2: Disable the CONNECT Method Internally

To satisfy the Qualys scan on a ProxySG, you need to create a policy that explicitly blocks the HTTP CONNECT method on standard, cleartext HTTP ports (typically 80 and 8080). This prevents external or unauthorized traffic from trying to tunnel SSL through your non-secure ports.

You can implement this remediation using either the Visual Policy Manager (VPM) or Content Policy Language (CPL).

Method 1: Using the Visual Policy Manager (VPM)

If you prefer the graphical administration interface, follow these steps to build your rule:

1. Open VPM: Log into the ProxySG Management Console and launch the Visual Policy Manager.

2. Select a Web Access Layer: Go to an existing Web Access Layer, or create a new one by navigating to Policy > Add Layer > Web Access Layer.

3. Configure the Service (HTTP Method):

   • Click the Service column of your new rule and select Set.

   • Click Add New Object and choose Protocol Methods

   • Give it a meaningful name (e.g., Method_CONNECT).

   • Click the Protocol dropdown and select HTTP/HTTPS

   • Check the box next to CONNECT under Common Methods

   • Click on Apply

   • Click on Set
     
     

4. Configure the Destination (HTTP Ports):

   • Click the Destination column and select Set.

   • Click New and choose Destination Host/Port.

   • Name it something descriptive (e.g., Port_80_8080).

   • Enter your port(s) or port ranges into the Port field

   • Press Apply
     
     
   • Press Set
     
     

5. Set the Action:

   • Click the Action column and change it to Deny (or Force Deny to guarantee that no subsequent policy layer accidentally overrides it).

6. Apply Policy: Click the Apply Policy button in the top toolbar to apply the configuration.
   
   

Method 2: Using Content Policy Language (CPL)

If you prefer managing your appliance via policy files or the Command Line Interface (CLI), you can paste a clean snippet of CPL into your local policy file:

Code snippet

<Proxy>
    http.method=CONNECT url.port=(80, 8080) FORCE_DENY

 

Tip: If your environment utilizes other non-standard cleartext ports for general HTTP proxying, just add them inside the parentheses separated by a comma (e.g., 80, 8080, 8000).