Local IP address visible in SIPOptions on port 5060

[dean.french.au]

One of our clients has had a penetration test performed and one of the points that we have been asked to remediate is that 3CX is presenting the local IP address of the 3CX server in its response when hit on port 5060 externally. For example, if I run nmap with the following command:

nmap -p5060 -sV --script fingerprint-strings -v <EXTERNAL_IP>

I get results containing the following:

PORT     STATE SERVICE VERSION
5060/tcp open  sip     (SIP end point; Status: 200 OK)
| fingerprint-strings:
|   SIPOptions:
|     SIP/2.0 200 OK
|     Via: SIP/2.0/TCP nm;branch=foo;received=<MY_EXTERNAL_IP>
|     Contact: <sip:192.168.0.20:5060;transport=tcp>
|     <sip:nm2@nm2>;tag=7e047f09
|     From: <sip:nm@nm>;tag=root
|     Call-ID: 50000
|     CSeq: 42 OPTIONS
|     Accept: application/sdp
|     Accept-Language: en
|     Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE, UPDATE
|     Supported: replaces, timer
|     Allow-Events: presence, message-summary, dialog, call-info, line-seize
|_    Content-Length: 0

You can see in the "Contact" field that it lists 192.168.0.20 which is the internal IP address of the 3CX server itself.

Is there a way I can remove this information or have it respond with the external IP address instead?

 

[YiannisH_3CX]

Hi @dean.french.au

I am afraid no. 3CX responds to OPTION messages blindly and there is no way to currently change that.

 

[dean.french.au]

Okay, so how would you recommend I proceed? I can't really go back to the customer and say "sorry, can't do anything about it", this has been identified by a reputable security company as a security flaw which needs to be remediated ASAP. I find it difficult to believe this hasn't been raised by anybody else in the past, I'm sure many 3CX customers have had similar penetration tests performed over the years.

 

[CentrexJ]

Lock port 5060 down to only your sip providers ip address(s) and the problem goes away.

You won’t be able to use stun configured remote desk phones.If you have those setup an sbc or switch them to use the 3CX applications.

 

[dean.french.au]

Thank you, that's exactly what I'll do!

 

[YiannisH_3CX]

You could also contact our security experts using the [email protected] email and report this. Our team will look into this and let you know.