> Source: [sk174149](https://support.checkpoint.com/results/sk/sk174149)

# sk174149 - Check Point response to "DNS Rebinding" on Security Gateway / Management Portals

| Property | Value |
|----------|-------|
| Solution ID | sk174149 |
| Date Created | 2021-06-30 |
| Last Modified | 2021-09-11 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- A malicious web page causes visitors to run a client-side script that attacks machines elsewhere on the network. Check Point products are NOT vulnerable to this.

## Cause

A DNS Rebinding attack is caused when a malicious DNS server is being used and returns different IP addresses for the same FQDN. This causes the browser to send data from one IP address to another IP address. If our Web portal does not check the Host header on the request and accepts any value, the data received may not have been initiated to our portal.  

Check Point user portals do not always check the Host header by definition, as access to the portal can be by IP addresses or FQDN set on the internal DNS server (as opposed to the internet where everyone accesses a site with the same FQDN).  

Read more about DNS Rebinding attack at <https://en.wikipedia.org/wiki/DNS_rebinding>

## Solution

While Check Point does not examine the Host header, as described above, we are not vulnerable for the following reasons:  

Since most portals are HTTPS, when the browser tries to establish a connection with the Web portal, a new TLS negotiation occurs and fails if the Host header in the request does not match the name in the presented server certificate.  

As to our clear-traffic HTTP Web portals, either there is no actionable endpoint, and/or the URL for action is unique and non-guessable.  

For example, the portal for CRL retrieval on port 18264 is a simple Web page with downloadable content and without any doable actions, which makes this portal useless for such an attack.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content