How to remediate – VMware AirWatch Console HTTP Detection

1. Introduction

VMware AirWatch Console HTTP Detection indicates the presence of a web server running VMware AirWatch, a mobile device management application. This matters to businesses as it identifies a potential entry point for attackers targeting corporate mobile devices and data. Affected systems are typically those used by organisations managing fleets of smartphones and tablets. A successful exploit could compromise confidentiality, integrity, and availability of managed devices and associated data.

2. Technical Explanation

• Root cause: The AirWatch Console web server is accessible, indicating a potential attack surface.
• Exploit mechanism: Attackers scan for exposed AirWatch consoles and then attempt to exploit known vulnerabilities or use default credentials.
• Scope: VMware AirWatch Console versions are affected. Specific versions depend on the deployment.

3. Detection and Assessment

• Quick checks: Access the AirWatch Console URL in a web browser. If it displays a login page, the service is present.
• Scanning: Nessus or other vulnerability scanners may identify this with ID 0001-T-0745. This is an example only.
• Logs and evidence: Web server logs may show access attempts to AirWatch Console URLs.

curl -I https://your_airwatch_url

4. Solution / Remediation Steps

The primary remediation is ensuring the service is appropriately secured, not necessarily removed. This involves verifying strong authentication and keeping the software updated.

4.1 Preparation

• Ensure you have access to the AirWatch Console administrative interface. A roll back plan involves restoring from the pre-change snapshot.
• A change window may be needed depending on the impact of service restarts. Approval from the IT security team is recommended.

4.2 Implementation

1. Step 1: Log in to the AirWatch Console administrative interface.
2. Step 2: Check that HTTPS is enforced and HTTP redirects to HTTPS.
3. Step 3: Verify strong password policies are enabled for all users.
4. Step 4: Review user access controls, ensuring least privilege principles are applied.
5. Step 5: Apply any available security patches or updates from VMware.

4.3 Config or Code Example

Before

# HTTP access allowed (example configuration)
http_enabled = true
https_redirect = false

After

# HTTPS enforced, HTTP redirects enabled (example configuration)
http_enabled = false
https_redirect = true

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include strong authentication and least privilege access control.

• Practice 1: Least privilege reduces the impact if an account is compromised.
• Practice 2: Strong password policies prevent brute-force attacks.

4.5 Automation (Optional)

# Example PowerShell script to check HTTPS redirection (requires AirWatch module)
# This is a simplified example and may require adjustments for your environment.
# Get-AirWatchSetting -Name "HTTPSRedirect" | Select-Object Value

5. Verification / Validation

Confirm the fix by verifying that HTTPS is enforced and HTTP redirects correctly. A smoke test should confirm normal user access.

• Post-fix check: Access http://your_airwatch_url in a web browser; it should redirect to https://your_airwatch_url.
• Re-test: Re-run the curl command from section 3; it should return an HTTP error or redirect response.
• Smoke test: Log in with a standard user account and verify access to managed devices.
• Monitoring: Monitor web server logs for any failed login attempts or unexpected HTTP traffic. This is an example only.

curl -I http://your_airwatch_url

6. Preventive Measures and Monitoring

Update security baselines to include HTTPS enforcement, strong password policies, and regular patching.

• Baselines: Update your organisation’s security baseline or policy to require HTTPS for all web applications.
• Pipelines: Include checks in CI/CD pipelines to ensure secure configurations are deployed.
• Asset and patch process: Implement a regular patch review cycle for AirWatch Console, ideally monthly.

7. Risks, Side Effects, and Roll Back

Enforcing HTTPS may cause compatibility issues with older clients. Rolling back involves reverting the configuration changes.

• Risk or side effect 2: Service interruption during patching if issues occur. Mitigation: Schedule patching during off-peak hours and have a roll back plan ready.
• Roll back: Revert the changes made in section 4.2, disabling HTTPS redirection and restoring previous password policies. Restore from snapshot if necessary.

8. References and Resources

• Vendor advisory or bulletin: https://www.air-watch.com/
• NVD or CVE entry: Not applicable for this detection finding.
• Product or platform documentation relevant to the fix: Refer to VMware AirWatch Console documentation on securing web access.