HackTricks-wiki · carlospolop · Sep 12, 2026
diff --git a/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md b/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md
@@ -304,6 +304,62 @@ In this setup:
 
 Ensure that actual, secure values are used to replace the placeholders when configuring the VPN.
 
+## Check Point IKEv1 client-controlled authentication flags (CVE-2026-50751)
+
+On affected Check Point Remote Access/Mobile Access gateways, this path is reachable when remote access is enabled, IKEv1 and legacy clients are accepted, and machine-certificate authentication is not mandatory. Certificate, certificate-with-enrollment, and mixed user-authentication modes are affected; legacy username/password mode is not directly bypassed because the later XAuth password check still applies.<sup>[[14]](#references)[[15]](#references)[[16]](#references)</sup>
+
+The vulnerable `processVendorIDPayload()` handler recognizes the 16-byte proprietary `VPNExtFeatures` magic below, reads the next four bytes as a network-order capability word, and stores it in the phase-1 state at `state + 0x4bc4`. Consequently, an unauthenticated peer controls flags later interpreted as authentication policy. Appending `00 00 00 04` sets bit `0x4`.<sup>[[14]](#references)[[15]](#references)</sup>
+
+```text
+3c f1 87 b2 47 40 29 ea 46 ac 7f d0 ea f2 89 f5 00 00 00 04
+```
+
+The relevant logic reduces to two short-circuit conditions.<sup>[[14]](#references)</sup>
+
+```c
+peer_flags = *(uint32_t *)(state + 0x4bc4);
+
+process_cert_payloads(msg, state, err, peer_flags & 2);
+if ((peer_flags & 2) && seekPayload(0xf9, ...) >= 0)
+    processSigPayload(...);
+
+if ((peer_flags & 4) || verifyMessagePhase1(...) >= 0)
+    return AUTH_SUCCESS;
+```
+
+Clearing bit `0x2` suppresses processing of Check Point machine-certificate payloads (`0xF6`) and their proof-of-key signature payload (`0xF9`). More directly, setting bit `0x4` makes the logical OR succeed without calling `verifyMessagePhase1()`. In the RSA-signature path this skips both signature verification and certificate-chain validation. The patch removes the caller-controlled certificate-policy argument and instead derives the decision from the gateway's machine-certificate mode at `state + 0x4bd4`.<sup>[[14]](#references)</sup>
+
+This is a general audit pattern for authentication state machines: trace every operand that gates certificate, MAC, token, password, or signature verification back to its trust origin. Conditions such as `attacker_flag || verify()` and `attacker_flag && process_proof()` are security boundaries even when the Boolean expression itself is valid.<sup>[[14]](#references)</sup>
+
+### Forged certificate identity and validation
+
+After suppressing the verifier, an attacker can attempt account mapping with an RSA-signature Main Mode exchange constructed as follows.<sup>[[14]](#references)[[15]](#references)</sup>
+
+1. Set the ID and self-signed certificate subject to `CN=<username>,OU=users,O=<ICA-O>`.
+2. Obtain the expected Internal Certificate Authority organization (`O=`) from the gateway's publicly served TLS certificate, or supply it explicitly.
+3. Send random bytes instead of a valid RSA signature; neither a trusted issuer nor possession of the generated private key is required on the vulnerable path.
+4. Include the `VPNExtFeatures` Vendor ID with capability `0x00000004`.
+
+The remaining identity lookup requires a provisioned Remote Access username. On a gateway already known to be vulnerable, the difference between rejection during user lookup and an accepted exchange can therefore act as a username oracle. Do not treat rejection alone as proof that a username is invalid: a patched gateway also rejects the forged signature.<sup>[[14]](#references)[[15]](#references)</sup>
+
+The watchTowr validation client implements this exchange for UDP/500, UDP/4500, and Check Point Visitor Mode. Visitor Mode is **raw TCPT framing over TCP/443, not TLS**, and carries the same IKE messages, so blocking only UDP/500 and UDP/4500 does not remove this path.<sup>[[14]](#references)[[15]](#references)</sup>
+
+```bash
+git clone https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751
+cd watchTowr-vs-Check-Point-CVE-2026-50751
+python3 -m venv .venv && . .venv/bin/activate && pip install cryptography
+python3 watchTowr-vs-Check-Point-CVE-2026-50751.py -rh <gateway> -u <username>
+python3 watchTowr-vs-Check-Point-CVE-2026-50751.py -rh <gateway> -rp 443 -u <username>
+```
+
+Use `-rp 4500` for NAT-T and `--org <ICA-O>` if automatic organization extraction fails. A successful result includes an encrypted Main Mode message 6 that the client can decrypt with the negotiated keys; this demonstrates creation of the phase-1 SA and may expose the gateway's internal IP identity. Run the check only against explicitly authorized systems because it authenticates as the supplied user.<sup>[[15]](#references)</sup>
+
+### Detection and remediation
+
+Network detection can parse IKEv1 message 1 Vendor ID payloads for the complete 20-byte value above rather than relying on fixed packet offsets. Also correlate `iked` messages containing `vendorid=0 ... not a Check Point peer` with subsequent successful SA creation such as `IkeSAFromState: User ... saved`; the anomalous sequence is stronger than either event alone.<sup>[[14]](#references)</sup>
+
+Install the fixed Jumbo Hotfix take or the dedicated `sk185033` hotfix. While patching, remove legacy-client support, enforce IKEv2-only remote access, or make machine-certificate authentication mandatory. Check Point explicitly notes that its IPS signature is a detection aid rather than remediation; also account for Visitor Mode on TCP/443 when applying temporary network controls.<sup>[[14]](#references)[[16]](#references)</sup>
+
 ## IKEv2 exploitation notes: pre-auth IDi/CERT processing bugs
 
 Modern VPN appliances often expose IKEv2 on UDP/500 (and UDP/4500 for NAT-T). A common pre-authentication attack surface is the parsing of Identification (IDi) and Certificate payloads during IKE_SA_AUTH.<sup>[[5]](#references)</sup>
@@ -383,5 +439,8 @@ Operational notes:
 - [11] [RFC 2409 – The Internet Key Exchange (IKEv1)](https://www.rfc-editor.org/rfc/rfc2409)
 - [12] [RFC 7296 – Internet Key Exchange Protocol Version 2 (IKEv2)](https://www.rfc-editor.org/rfc/rfc7296)
 - [13] [RFC 3947 – Negotiation of NAT-Traversal in IKE](https://www.rfc-editor.org/rfc/rfc3947)
+- [14] [watchTowr Labs - Marking Your Own Homework: Check Point Remote Access VPN IKEv1 Authentication Bypass](https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751)
+- [15] [watchTowr CVE-2026-50751 Detection Artefact Generator](https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751)
+- [16] [Check Point sk185033 - IKEv1 Remote Access and Mobile Access authentication bypass](https://support.checkpoint.com/results/sk/sk185033)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md
@@ -165,6 +165,12 @@ Why this matters during pentests:
 
 Also keep internet-exposed **Remote Access VPN / Mobile Access** gateways in scope. In 2024, Check Point disclosed and observed exploitation around an information-disclosure issue affecting internet-connected gateways with remote access enabled.<sup>[[7]](#references)</sup> From an operator perspective, the practical lesson is to treat VPN portals and Gaia / management surfaces as a single attack chain: pre-auth leakage on the gateway can feed username discovery, credential attacks, and authenticated follow-on abuse against the management plane.
 
+For IKE negotiation and the Check Point IKEv1 client-controlled authentication-flags case study, see:<sup>[[13]](#references)</sup>
+
+{{#ref}}
+ipsec-ike-vpn-pentesting.md#check-point-ikev1-client-controlled-authentication-flags-cve-2026-50751
+{{#endref}}
+
 ## HTTP Security Server Format String Bug (CAN-2004-0039)
 
 **Affected builds:** NG FCS, NG FP1, NG FP2, NG FP3 HF2, and NG with Application Intelligence R54/R55.  
@@ -210,5 +216,6 @@ Compromise of the proxy grants code execution inside the firewall process (SYSTE
 - [10] [Check Point Advisory sk185169 – CVE-2026-16232 SmartConsole Authentication Bypass](https://support.checkpoint.com/results/sk/sk185169/)
 - [11] [Check Point Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/)
 - [12] [Check Point R82.10 – Firewall Control Connections in VPN Communities](https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Control-Connections-in-VPN.htm)
+- [13] [watchTowr Labs - Marking Your Own Homework: Check Point Remote Access VPN IKEv1 Authentication Bypass](https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751)
 
 {{#include ../banners/hacktricks-training.md}}