Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 28 replies
  • Subscribers 49 subscribers
  • Views 8782 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG is contacting whatfix.com when I change firewall rules

EdmundSackbauer

I noticed that when using the GUI, and do some changes to rules or policies, that in bottom left corner of my browser there is "waiting for whatfix.com".

So it seems the XG is sending information to that website. Why is it doing this? What data is transferred? And how can I disable that?

Running Browser Inspections this is shown:

<script type="text/javascript" charset="utf-8" integrity="sha384-Ri1cUxmQGTk6k9rHS1TVx4oxxxxxxxxxxxxxxxxxxxxxp5yiG53soWAwGA4pxnnd" crossorigin="anonymous" src="">cdn.whatfix.com/.../script>

Even Javascript is downloaded! Why?



This thread was automatically locked due to age.
Parents
  • 0

    I don't understand this posting. On the one hand, you say multiple times that the XG is contacting a website, but then you note multiple times that it is your browser that is contacting the website. The latter appears to be correct.

  • 0 in reply to Wayne Folta

    And what could you possible do in a hijacked browser session which holds an admin session to the XG?

  • 0 in reply to EdmundSackbauer

    You don't have to confound the actual issue in order for it to matter. A subtle new vector for a potential exploit is a serious issue. But the XG is not in contact with the server, your web browser is.

    I'll add that, per your discovery and awaiting clarifications from Sophos, I'm disabling connections to whatfix.com in my laptop firewall, which indicates 16 outgoing connections to whatfix.com (104.18.30.171, 104.18.31.171) and 3 to cdn.whatfix.com (104.18.31.171) since we got the EAP.

    Again, this is a good find. I just want to describe it accurately so as not to obscure the actual issue. From the whatfix website:

    Whatfix is an award-winning SaaS-based platform that allows businesses create interactive guides on their web platforms. The company's patent-pending technology can be integrated with ease across all user touch-points inside web applications.

Reply
  • 0 in reply to EdmundSackbauer

    You don't have to confound the actual issue in order for it to matter. A subtle new vector for a potential exploit is a serious issue. But the XG is not in contact with the server, your web browser is.

    I'll add that, per your discovery and awaiting clarifications from Sophos, I'm disabling connections to whatfix.com in my laptop firewall, which indicates 16 outgoing connections to whatfix.com (104.18.30.171, 104.18.31.171) and 3 to cdn.whatfix.com (104.18.31.171) since we got the EAP.

    Again, this is a good find. I just want to describe it accurately so as not to obscure the actual issue. From the whatfix website:

    Whatfix is an award-winning SaaS-based platform that allows businesses create interactive guides on their web platforms. The company's patent-pending technology can be integrated with ease across all user touch-points inside web applications.

Children
  • 0 in reply to Wayne Folta

    "But the XG is not in contact with the server, your web browser is."
    That is true, however the problem is that I am logged in as admin with my browser. There is javascript downloaded from an external URL. And I guess Cross-Site-Scripting is enabled for Whatfix.com, or the assistent wouldn't be able to work.

    So somebody using DNS cache poisoning or even hacking whatfix.com could potentially take over your firewall (open GUI to WAN, reset passwords etc).

  • 0 in reply to EdmundSackbauer

    Totally true. The outcome is the same no matter how we state it. But I think the statement should be accurate. The XG is not contacting an external site. The HTTP you get from the XG includes a link to that site and your web browser reaches out, and that opens a potential exploit. True.

    All I'm saying is the description's accuracy matters, not just the point that there is a potential problem that the new SFOS introduced.

  • 0 in reply to Wayne Folta

    what kind of action did you take against Sophos? Someone already having a case ID?

    I'd create one as soon as we're on the new version next week Adding existing case# to new cases speeds things up.

    Disabling that by adding block rules is not what I like.

    I also think this has been introduced for new Sophos admins. It is OK but there should be something on GUI to disable it because I see it  as a security issue.

Unfiltered HTML