Security Issues with Duda CDN and Enterprise, Larger Clients
Has anyone else run into this issue with one of their larger-sized clients that has an enterprise firewall installed?
One of my clients was viewing their website editor and website within their VPN network, but some of the pages were off (Pics not showing, page design all scrambled up, etc..). They checked with their internal IT department, and the firewall company (Palo Alto Networks) was blocking URLs on the site that started with the CDN URL (irp.cdn-website). Palo Alto Networks said they were blocking those URLs because other URLs on Duda's CDN network had malicious content (Phishing and malware).
I have a ticket outstanding, and Duda support said they removed those files, but who knows when the security companies will clear it up? I checked with VirusTotal.com (You can see the screenshot), and two vendors still mark the CDN URL Duda uses as Malicious.
My question is, has anyone else run into this? If so, how did you resolve it? Could any enterprise company with an enterprise firewall have issues viewing a Duda-built website?
Answers
-
That is definitely above all our pay grades. lol.. Tagging @ScottyStrehlow for this so he can get the right people involved. The issue here is if Duda corrected it, it is up to the 3rd parties to rescan and reclassify the CDN on their end.
0 -
@Aj_Cre8 I was able to get support from the support and security management team, and they did take my concern seriously and will be implementing tightened security measures that will hopefully prevent this from happening again across their platform.
1 -
Our team is on it. Thank you @Aj_Cre8 and @Danny_Crumpton!
1 -
Hey @Ryan_Burke I share your experience. My organization also keeps blocking things according to whatever Palo Alto Networks says without telling anyone or checking on the impact to our operations.
One day people started complaning about missing content, images, fonts etc and after much troubleshooting we eventually discovered they blocked cross-origin resource sharing (CORS). Our IT team whitelist Duda's CDNs.
Went through the same thing with RSS - Palo Alto says no RSS, so nobody could see the feed for ages until I could get whitelisting approved.
0 -
Hi all, has anyone heard back on this issue. None of my sites get passed corporate firewalls. Been trying to figure out if there is something I can do on my end to get whitelisted.
0
