Check Point has recently disclosed a critical vulnerability in its Security Management Server and Multi-Domain Security Management Server (MDS) that can allow unauthenticated attackers with network access to execute arbitrary commands on vulnerable management servers.

Through this blog, we will understand what the authentication bypass flaw in Check Point’s security management server is about and some of the security actions that organizations can take to prevent/respond to the threat.  

About the vulnerability

What can attackers do with the vulnerability?

Attackers can exploit the vulnerability to:

• Bypass authentication mechanisms without valid credentials
• Execute arbitrary commands to install malware, steal data or take control of the system
• Cause a complete compromise of the Check Point Security Management environment
• Make unauthorized modification of firewall and security policies
• Take administrative control over centrally managed gateways
• Gain unauthorized access to sensitive security configurations
• Laterally move into protected internal network segments
• Disrupt enterprise security operations

SharkStriker’s recommendations

SharkStriker recommends implementing the following:

• Apply the latest Check Point Jumbo Hotfix Accumulator immediately.
• Upgrade unsupported Check Point Security Management Server versions to supported releases.
• Review and tighten Trusted Client configurations.
• Restrict administrative access to dedicated management workstations and trusted networks only.
• Ensure Security Management interfaces are never exposed to the Internet.
• Audit recent administrative activity and security policy changes for unauthorized modifications.
• Continuously monitor authentication logs and management server activity for suspicious behavior.

SharkStriker’s Actions

• Validated Intelligence.
• Initiated a customer impact assessment.
• Prepared an advisory for the affected customers.
• Notified the detection engineering team to review monitoring coverage.
• Recommended threat hunting for suspicious authentication attempts and unauthorized administrative activity targeting Check Point Management Servers.