Solved 3CX Open Port 5001 -

[Venice]

Pentesting is performed on our external network. The report showed that 3CX opened port is not safe.

Finding
The remote web server is not enforcing HSTS (HTTP Strict-Transport-Security), as defined by RFC 6797.

Risk
The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Recommendation
Configure the remote web server to use HSTS.

Anyone have idea how to remediate this issue?

 

[Agathocles Prodromou]

Hi @Venice ,

Nginx does send the HSTS header on https ports.

Generally, the danger in such cases where the HSTS header is not present (in our case it is), as the description provided by the tool used to scan the network indicates, is mainly for the connection to be downgraded (to HTTP) by a malicious actor. The main prerequisite is for them to be on the same local network as you in order to perform a MiTM attack. The HTTP port of the PBX though is accessible only locally so even in case someone did manage to perform MiTM you would all need to be on the same lan as 3CX and with the HTTP port accessible.

P.S: The lack of a header and it being present but not as defined by the RFC is two different things.

 

[Venice]

Based on the external pentest report, what is the conclusion we can feedback to them?
Nginx does send the HSTS header on https ports but HSTS is not enforced.
How to enforce it?

 

[Agathocles Prodromou]

I am afraid "it is not enforced" is vague. Different scanning software might categorize this differently. Is it because the header is really not there or is it because it doesn't include flags such as IncludeSubDomains and preload? What is the exact endpoint on the pbx this was detected? What are the actual response headers sent by the server? Is it certain that the response the software received is from the PBX and not an intermediate service such as a firewall or a proxy?

In order for the result of automated scans to be properly assessed, context and technical information is needed.

 

[Venice]

The reply is quite confusing. The Pentest team is using Nessus Professional and reported the 3CX server on port 5001 vulnerability.
1) Any parameter we can configure inside the 3CX server to enforce HSTS?
2) What is the implication if port 5001 is closed?

 

[Agathocles Prodromou]

The http server configuration in 3cx is secure.

As mentioned in my earlier post the PBX is sending the header and the browser has to enforce it. I am afraid you will have to take it on with the pen-testing team to discuss the results and provide you with more details as to why Nessus is reporting something different. That is beyond the scope of a support post.