Toggle sidebar Toggle sidebar

PCI Compliance Failure

Status
Not open for further replies.

treynolen

Gold Partner
Advanced Certified
Joined
Feb 14, 2019
Messages
42
Reaction score
2
I've got a client who is failing PCI Compliance scans because of his on-premise 3CX install. This is the report:

--BEGIN
5.0 FAIL Port: 5001 Protocol: TCP Service: www Title: Multiple Web Server Encoded Space (%20) Request ASP Source Disclosure

Synopsis
The remote web server is affected by an information disclosure vulnerability.

Impact
It appears possible to get the source code of the remote ASP scripts by appending a '%20' to the request. ASP source code usually contains sensitive information such as logins and passwords. This has been reported in Simple HTTPD (shttpd), Mono XSP for ASP.NET and vWebServer. This type of request may affect other web servers as well. See also : https://seclists.org/bugtraq/2006/Dec/326 https://seclists.org/bugtraq/2007/Jun/260

Resolution
There is no known solution at this time.

Data Received
SecurityMetrics was able to retrieve the source of '/default.asp' by sending the following request : https://174-085-163-093.res.spectrum.com:5001/default.asp Here is the full response : ------------------------------ snip ------------------------------ HTTP/1.1 200 OK Server: nginx Date: Wed, 19 Jan 2022 23:22:57 GMT Content-Type: application/octet-stream Content-Length: 228 Connection: keep-alive Content-Type: text/html <html><body><h1>Unfortunately, you are using an outdated and unsupported browser.<br>Please upgrade your browser to improve your experience and security.<br>Supported browsers: Chrome, Edge, Safari or Firefox.</h1></body></html>------------------------------ snip ------------------------------

CVEs
CVE-2001-1248 Score: 5.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
CVE-2007-3407 Score: 5.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

---END


What is the recommended way of dealing with this? These vulnerabilities are from 2001 and 2007, so I don't guess they are going to be fixed anytime soon. No interest in going 3CX hosted for this client. Install is on the latest 18.0 Update 2.
 
Lock it down or report it as a false positive.

or VLAN it off and give it its own WAN IP.
 
ISP is only giving the customer one IP. The only ports open are the ones required by 3CX. Is there any further action to "Lock it down"?

I will attempt to report a false positive, but it looks like a legitimate issue to me, so I don't know if they will allow it.
 
treynolen said:
ISP is only giving the customer one IP. The only ports open are the ones required by 3CX. Is there any further action to "Lock it down"?

I will attempt to report a false positive, but it looks like a legitimate issue to me, so I don't know if they will allow it.
Click to expand...
Lock the ports to authorized IPs as much as possible. If you don't use STUN phones, block 5060 to your provider.
 
The CVEs they are reporting are due to Nginx leaking data. They are complaining about port 5001 and that is required because this customer is using softphones/apps.
 
Second internet circuit then? 3CX doesn't need much in the way of bandwidth
 
In this area, a second circuit would represent a minimum monthly cost of around $100. It would seem that if small businesses who want to take credit cards can't do so because of using a 3CX phone system, that would be something that 3CX might want to address.
 
At that point wouldn't it be better to host the server in a cloud VM (well secured of course) and use the SBC on-site? This prevents any incoming connections, so no PCI issues.
 
  • Like
Reactions: CentrexJ
Again, the client will incur costs which seem to be associated with problems in the platform.
 
It is as @SteveITS says, the 'leak' that it is probably detecting is the fact that nginx is replying with this:
HTML: 
<html>
<body>
<h1>
Unfortunately, you are using an outdated and unsupported browser.<br>
Please upgrade your browser to improve your experience and security.<br>
Supported browsers: Chrome, Edge, Safari or Firefox.
</h1>
</body>
</html>
I formatted it a bit to be easier to read.

This is completely harmless and quite frankly should be disregarded by the company doing the PCI compliance work.

If they can somehow retrieve more information than this, then I would like to know about it and we can investigate further.
 
We have a client going through this failure as well. The request for an exception did not go well. Their response:
"The issue in this exception case is for CVE-2019-1559, specifically for Goldendoodle. The scanner sent an invalid MAC with valid padding value. The response returned by the scan target indicates that the invalid request was accepted at the SSL level which confirms the presence of the vulnerability. Please refer to the Vulnerability Details report description section (QID Detection Logic) and the second part of the Evidence section - The server returns valid data in response to valid padding with an invalid MAC.

In our case we decided relocate 3CX.
 
treynolen said:
Again, the client will incur costs which seem to be associated with problems in the platform.
Click to expand...
It's called the cost of doing business. If it's cheaper to switch PBXs than it is to either get second internet connection or switch to the cloud and use a SBC then so be it.
 
As a small mail order business. I host my own 3cx install on a very modest digital ocean server. The benefits of off premise out weigh the minor costs incurred. When the power is out or Internet goes out, I can take calls on my mobile via the 3cx app or from home with the desktop app if I'm working remotely. If that was on prem, we'd have to use our sip trunks disaster recovery which basically just forward calls to a cell phone.

Obviously I have no clue what kind of business they run and maybe phones are not as mission critical to them as they are to me. I really don't see why anyone would run on premise these days without redundant Internet.
 
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,974
Messages
590,083
Members
164,901
Latest member
Silent_Guru
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom