topic Re: Feature Request Firewall + WAF (would have been protected against CVE-2024-24919) in General Topics

Feature Request Firewall + WAF (would have been protected against CVE-2024-24919)

HeikoAnkenbrand — Mon, 03 Jun 2024 06:52:36 GMT

Check Point has been selling firewalls for years and WAFs for some years now.
The interesting question for me is why this is not combined.

For example, there was a WAF in front of the GAIA portal (multi-portal) or the MAB portal,
the attack (CVE-2024-24919) could easily have been detected and can be blocked.

Technically, I don't see any difficulties in implementing something like this.

And both technologies are available from Check Point.
And you would be the first firewall manufacturer to protect its products in this way.

Re: Feature Request Firewall + WAF (would have been protected against CVE-2024-24919)

_Val_ — Mon, 03 Jun 2024 07:01:48 GMT

WAF is insufficient here. Full inbound HTTPS Inspection is required, and it is already being reviewed as an option. We are looking into this very seriously.

Re: Feature Request Firewall + WAF (would have been protected against CVE-2024-24919)

HeikoAnkenbrand — Mon, 03 Jun 2024 08:23:15 GMT

@Dorit_Dor
Is a feature request for the future.

Why can't you build a WAF in front of your web portals on the firewall in R82.x or R8x in the future?
Then attacks like these would be intercepted on the Check Point firewall.

Browser --> (WAF with Https interseption as reverse proxy) --> (Gaia Portal or MAB Portal)
From my point of view, any WAF would sound an alarm when the following string ‘../../../../../’ is used in communication.

Re: Feature Request Firewall + WAF (would have been protected against CVE-2024-24919)

Gera_Dorfman — Tue, 04 Jun 2024 08:59:11 GMT

Hi Heiko

We are indeed considering additional protective measures to avoid such issues in the future. Integrating WAF is one of the options.

Thanks

Re: Feature Request Firewall + WAF (would have been protected against CVE-2024-24919)

PhoneBoy — Thu, 06 Jun 2024 01:23:36 GMT

In a sense, we've provided this already in the form of vpnf.
The new vpnf process (deployed through AutoUpdater or manually) captures and prevents attempts to execute path traversal.
This was deployed as an interim preventative measure until the CVE-2024-24919 fixes are fully installed on customers’ Security Gateways.
More details here: https://support.checkpoint.com/results/sk/sk182376

Despite the presence of vpnf, installing the Hotfix is the best way to stay protected from this vulnerability.