diff --git a/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md b/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md index 311dbe86108..f30854b3f6d 100644 --- a/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md +++ b/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md @@ -304,6 +304,62 @@ In this setup: Ensure that actual, secure values are used to replace the placeholders when configuring the VPN. +## Check Point IKEv1 client-controlled authentication flags (CVE-2026-50751) + +On affected Check Point Remote Access/Mobile Access gateways, this path is reachable when remote access is enabled, IKEv1 and legacy clients are accepted, and machine-certificate authentication is not mandatory. Certificate, certificate-with-enrollment, and mixed user-authentication modes are affected; legacy username/password mode is not directly bypassed because the later XAuth password check still applies.[[14]](#references)[[15]](#references)[[16]](#references) + +The vulnerable `processVendorIDPayload()` handler recognizes the 16-byte proprietary `VPNExtFeatures` magic below, reads the next four bytes as a network-order capability word, and stores it in the phase-1 state at `state + 0x4bc4`. Consequently, an unauthenticated peer controls flags later interpreted as authentication policy. Appending `00 00 00 04` sets bit `0x4`.[[14]](#references)[[15]](#references) + +```text +3c f1 87 b2 47 40 29 ea 46 ac 7f d0 ea f2 89 f5 00 00 00 04 +``` + +The relevant logic reduces to two short-circuit conditions.[[14]](#references) + +```c +peer_flags = *(uint32_t *)(state + 0x4bc4); + +process_cert_payloads(msg, state, err, peer_flags & 2); +if ((peer_flags & 2) && seekPayload(0xf9, ...) >= 0) + processSigPayload(...); + +if ((peer_flags & 4) || verifyMessagePhase1(...) >= 0) + return AUTH_SUCCESS; +``` + +Clearing bit `0x2` suppresses processing of Check Point machine-certificate payloads (`0xF6`) and their proof-of-key signature payload (`0xF9`). More directly, setting bit `0x4` makes the logical OR succeed without calling `verifyMessagePhase1()`. In the RSA-signature path this skips both signature verification and certificate-chain validation. The patch removes the caller-controlled certificate-policy argument and instead derives the decision from the gateway's machine-certificate mode at `state + 0x4bd4`.[[14]](#references) + +This is a general audit pattern for authentication state machines: trace every operand that gates certificate, MAC, token, password, or signature verification back to its trust origin. Conditions such as `attacker_flag || verify()` and `attacker_flag && process_proof()` are security boundaries even when the Boolean expression itself is valid.[[14]](#references) + +### Forged certificate identity and validation + +After suppressing the verifier, an attacker can attempt account mapping with an RSA-signature Main Mode exchange constructed as follows.[[14]](#references)[[15]](#references) + +1. Set the ID and self-signed certificate subject to `CN=,OU=users,O=`. +2. Obtain the expected Internal Certificate Authority organization (`O=`) from the gateway's publicly served TLS certificate, or supply it explicitly. +3. Send random bytes instead of a valid RSA signature; neither a trusted issuer nor possession of the generated private key is required on the vulnerable path. +4. Include the `VPNExtFeatures` Vendor ID with capability `0x00000004`. + +The remaining identity lookup requires a provisioned Remote Access username. On a gateway already known to be vulnerable, the difference between rejection during user lookup and an accepted exchange can therefore act as a username oracle. Do not treat rejection alone as proof that a username is invalid: a patched gateway also rejects the forged signature.[[14]](#references)[[15]](#references) + +The watchTowr validation client implements this exchange for UDP/500, UDP/4500, and Check Point Visitor Mode. Visitor Mode is **raw TCPT framing over TCP/443, not TLS**, and carries the same IKE messages, so blocking only UDP/500 and UDP/4500 does not remove this path.[[14]](#references)[[15]](#references) + +```bash +git clone https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751 +cd watchTowr-vs-Check-Point-CVE-2026-50751 +python3 -m venv .venv && . .venv/bin/activate && pip install cryptography +python3 watchTowr-vs-Check-Point-CVE-2026-50751.py -rh -u +python3 watchTowr-vs-Check-Point-CVE-2026-50751.py -rh -rp 443 -u +``` + +Use `-rp 4500` for NAT-T and `--org ` if automatic organization extraction fails. A successful result includes an encrypted Main Mode message 6 that the client can decrypt with the negotiated keys; this demonstrates creation of the phase-1 SA and may expose the gateway's internal IP identity. Run the check only against explicitly authorized systems because it authenticates as the supplied user.[[15]](#references) + +### Detection and remediation + +Network detection can parse IKEv1 message 1 Vendor ID payloads for the complete 20-byte value above rather than relying on fixed packet offsets. Also correlate `iked` messages containing `vendorid=0 ... not a Check Point peer` with subsequent successful SA creation such as `IkeSAFromState: User ... saved`; the anomalous sequence is stronger than either event alone.[[14]](#references) + +Install the fixed Jumbo Hotfix take or the dedicated `sk185033` hotfix. While patching, remove legacy-client support, enforce IKEv2-only remote access, or make machine-certificate authentication mandatory. Check Point explicitly notes that its IPS signature is a detection aid rather than remediation; also account for Visitor Mode on TCP/443 when applying temporary network controls.[[14]](#references)[[16]](#references) + ## IKEv2 exploitation notes: pre-auth IDi/CERT processing bugs Modern VPN appliances often expose IKEv2 on UDP/500 (and UDP/4500 for NAT-T). A common pre-authentication attack surface is the parsing of Identification (IDi) and Certificate payloads during IKE_SA_AUTH.[[5]](#references) @@ -383,5 +439,8 @@ Operational notes: - [11] [RFC 2409 – The Internet Key Exchange (IKEv1)](https://www.rfc-editor.org/rfc/rfc2409) - [12] [RFC 7296 – Internet Key Exchange Protocol Version 2 (IKEv2)](https://www.rfc-editor.org/rfc/rfc7296) - [13] [RFC 3947 – Negotiation of NAT-Traversal in IKE](https://www.rfc-editor.org/rfc/rfc3947) +- [14] [watchTowr Labs - Marking Your Own Homework: Check Point Remote Access VPN IKEv1 Authentication Bypass](https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751) +- [15] [watchTowr CVE-2026-50751 Detection Artefact Generator](https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751) +- [16] [Check Point sk185033 - IKEv1 Remote Access and Mobile Access authentication bypass](https://support.checkpoint.com/results/sk/sk185033) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md index d2e8e162a34..e9fb51d2bef 100644 --- a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md +++ b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md @@ -165,6 +165,12 @@ Why this matters during pentests: Also keep internet-exposed **Remote Access VPN / Mobile Access** gateways in scope. In 2024, Check Point disclosed and observed exploitation around an information-disclosure issue affecting internet-connected gateways with remote access enabled.[[7]](#references) From an operator perspective, the practical lesson is to treat VPN portals and Gaia / management surfaces as a single attack chain: pre-auth leakage on the gateway can feed username discovery, credential attacks, and authenticated follow-on abuse against the management plane. +For IKE negotiation and the Check Point IKEv1 client-controlled authentication-flags case study, see:[[13]](#references) + +{{#ref}} +ipsec-ike-vpn-pentesting.md#check-point-ikev1-client-controlled-authentication-flags-cve-2026-50751 +{{#endref}} + ## HTTP Security Server Format String Bug (CAN-2004-0039) **Affected builds:** NG FCS, NG FP1, NG FP2, NG FP3 HF2, and NG with Application Intelligence R54/R55. @@ -210,5 +216,6 @@ Compromise of the proxy grants code execution inside the firewall process (SYSTE - [10] [Check Point Advisory sk185169 – CVE-2026-16232 SmartConsole Authentication Bypass](https://support.checkpoint.com/results/sk/sk185169/) - [11] [Check Point Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/) - [12] [Check Point R82.10 – Firewall Control Connections in VPN Communities](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Control-Connections-in-VPN.htm) +- [13] [watchTowr Labs - Marking Your Own Homework: Check Point Remote Access VPN IKEv1 Authentication Bypass](https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751) {{#include ../banners/hacktricks-training.md}}