The Gateway Actuator endpoint was previously enabled by default in versions prior to 3.1.1+ and 3.0.7+ by default. The endpoint could be exposed or unsecured. For example, the endpoint could live on the same machine as the gateway where it's vulnerable to a code injection attack. This could be either due to misconfiguration or due to an unsecure remote connection that does not use HTTPS. An unsecure connection allows for man-in-the-middle attacks that could allow for the execution of a maliciously crafted script that could allow for the execution of arbitrary commands on the gateway. This could allow for the attacker to take over the gateway, or worse.
How do I find out if my gateway is vulnerable?
The easiest way to find out if your gateway is vulnerable is to install the latest version of the gateway and compare the URL returned when a device connects. If it's not HTTPS and HTTP, then your gateway is vulnerable.
How do I protect my gateway?
The easiest way to protect your gateway is by using the following steps:
1. Ensure that remote connections are secured using HTTPS, and that the endpoint is disabled by default.
2. Put your gateway behind a firewall or network address translation (NAT) device.
3. Put your gateway in an isolated environment where it cannot communicate with other computers or servers on the network.