How to remediate – Check Point FireWall-1 Open Web Administration

1. Introduction

The Check Point FireWall-1 Open Web Administration vulnerability allows remote access to the firewall’s web interface, potentially enabling attackers to launch brute-force password attacks and gain control of the system. This poses a significant risk to business confidentiality, integrity, and availability as successful exploitation could lead to data breaches, service disruption, or complete system compromise. Affected systems are Check Point FireWalls configured with remote Web administration enabled. A successful attack can result in full firewall control.

2. Technical Explanation

The vulnerability stems from the exposure of a web-based management interface without sufficient access controls. An attacker can attempt to brute-force valid credentials through this interface, potentially gaining administrative access. There is no known CVE associated with this specific issue but it’s commonly identified during security assessments. For example, an attacker could use tools like Hydra or Medusa to automate password guessing against the web administration port (typically 80 or 443).

• Root cause: The firewall allows remote Web administration access without strong authentication requirements.
• Exploit mechanism: An attacker attempts to gain unauthorized access by repeatedly submitting username and password combinations via the web interface.
• Scope: Check Point FireWall-1 appliances with the Web administration interface enabled are affected.

3. Detection and Assessment

To confirm vulnerability, check if remote Web administration is enabled on the firewall. A thorough assessment involves attempting to access the web interface from a remote location.

• Quick checks: Use the command fw ctl show int to view interface settings and identify if Web administration is active.
• Scanning: Nessus plugin ID 32864 can detect open web administration interfaces on Check Point firewalls, but results should be verified manually.
• Logs and evidence: Examine firewall logs for connection attempts to ports 80 or 443 from unexpected sources.

fw ctl show int

4. Solution / Remediation Steps

To fix the issue, disable remote Web administration or restrict access using filtering rules.

4.1 Preparation

• Dependencies: Ensure you have console or SSH access to the firewall in case of issues. Roll back plan: Restore from backup if necessary.
• Change window needs: This change requires a brief maintenance window, and approval may be needed depending on your organization’s policies.

4.2 Implementation

1. Step 1: Disable remote Web administration using the command fw ctl set int web_admin off.
2. Step 2: Save the configuration using the command fw ctl saveconfig.

4.3 Config or Code Example

Before

interface web_admin {
  enabled on;
}

After

interface web_admin {
  enabled off;
}

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact if exploited, and safe defaults minimize exposure by disabling unnecessary services.

• Practice 1: Implement least privilege principles to limit user access to only necessary resources.
• Practice 2: Use safe defaults by disabling remote administration interfaces unless explicitly required.

4.5 Automation (Optional)

# Example Ansible snippet to disable Web administration
- name: Disable Check Point Web Administration
  command: fw ctl set int web_admin off
  when: ansible_os_family == 'Checkpoint'
  become: yes

5. Verification / Validation

Confirm the fix by verifying that remote Web administration is disabled and no longer accessible from external networks.

• Post-fix check: Run fw ctl show int and confirm that web_admin is set to off.
• Re-test: Attempt to access the web interface from a remote location; it should be unreachable or require valid credentials only.
• Smoke test: Verify other firewall functions, such as VPN connectivity and traffic filtering, are still working correctly.
• Monitoring: Monitor firewall logs for any attempts to connect to ports 80 or 443 from unauthorized sources.

fw ctl show int

6. Preventive Measures and Monitoring

Update security baselines to include disabling unnecessary services, such as remote Web administration. Implement CI/CD pipeline checks to prevent the re-enablement of vulnerable configurations.

• Baselines: Update your firewall security baseline or policy to enforce the disabling of remote Web administration interfaces.
• Pipelines: Add configuration validation checks in your CI/CD pipelines to ensure that new firewall deployments do not enable unnecessary services.
• Asset and patch process: Review firewall configurations regularly as part of a defined asset management and patching process.

7. Risks, Side Effects, and Roll Back

Disabling remote Web administration may require alternative methods for managing the firewall, such as console access or SSH. If issues arise, restore from backup to revert the changes.

• Risk or side effect 1: Loss of remote web-based management access; ensure alternate access methods are available.
• Roll back: Restore the firewall configuration from a previous backup if necessary.

8. References and Resources

• Vendor advisory or bulletin: Check Point Support Center – Web Administration Interface
• NVD or CVE entry: No specific CVE is associated with this issue, but related vulnerabilities can be found on the NVD website.
• Product or platform documentation relevant to the fix: Check Point Firewall Administration Guide