topic Re: http port 80 in Network Security

http port 80

Lake — Fri, 21 Feb 2020 14:45:04 GMT

Hi Guys,

We have an isensor device sitting behind our firewall and we keep getting alerts from the isensor device that http header is not blocked for that specified device. The only port that is open to that IP Address is smtp port 25. So why is the isensor saying that http is not blocked. Any help would greatly appreciated. I have pasted the isensor output below:

Incident Summary The CTOC has received an alert for '54322 VID90223 Generic OGNL Injection Attempt Inbound - HTTP Header' from your iSensor device (198.10.1.21) for traffic (Not Blocked) destined to port 80/tcp of 198.10.1.21 that occurred on 2017-11-13 at 19:25:53. This may indicate that 133.22.217.11 is attempting to discover whether 198.10.1.21 is vulnerable to OGNL injection. Object-Graph Navigation Language (OGNL) is a Java-based expression language that exposes some of the functionality of Java. Attacker controlled input that gets evaluated as OGNL on the target's system(s) can result in arbitrary code execution.

Thanks,

Lake

Re: http port 80

Seb Rupik — Tue, 14 Nov 2017 15:17:41 GMT

Hi there,

What's the output from:

packet-tracer input OUTSIDE tcp 133.22.217.11 45000 198.10.1.21 80

(assuming your outbound interface is named 'OUTSIDE')

cheers,

Seb.

Re: http port 80

Lake — Tue, 14 Nov 2017 15:23:34 GMT

Hi Seb,

I don't have a packet tracer output from our ASA firewall. This is a snippet of the isensor output. Any idea why we keep getting these alerts?

Thanks,

Lake

Re: http port 80

Seb Rupik — Tue, 14 Nov 2017 15:26:40 GMT

Hi Lake,

What I am trying to determine is if traffic from the internet is actually being forward to your sensor. Since 133.22.217.11 is a globally routable address then I suspect the answer is yes. The packet-tracer output would confirm this.

cheers,

Seb.

Re: http port 80

Lake — Tue, 14 Nov 2017 15:35:13 GMT

Hi Seb,

Is it possible to for http traffic from the internet to go through the ASA even that port is not open on the firewall? By this I mean any http traffic?

Thanks,

Lake

Re: http port 80

Seb Rupik — Tue, 14 Nov 2017 15:39:13 GMT

It looks as if it is being forwarded from the outside to your sensor. Do you has access to the ASA to check the NAT rules?

There is the remote possibility of the source IP being spoofed, and the traffic is originating from somewhere within your network.

Re: http port 80

Lake — Tue, 14 Nov 2017 15:46:08 GMT

I will open a case with Cisco and let them take a look at it. I appreciate all your help.

Thanks,

Lake