Resolve a phishing vulnerability in Hybrid Access Gateway and Digital Access

This instruction describes how to resolve a phishing vulnerability in Hybrid Access Gateway 5.13.0 to 5.13.5.

The needed file can be accessed here: https://support2.nexusgroup.com/Release/?sub=/SSO%20Vulnerability%20fix%20-%20DA-282/5.13.5%20and%20earlier&cat=Nexus%20Hybrid%20Access%20Gateway

1. Move the provided file access-point to the virtual appliance.
2. ssh into the machine.
3. Exit from the bash menu and elevate the prompt (use, for example, sudo su - )
4. Go to /opt/nexus/access-point/bin.

5. Stop the access point:

   Stop access point

   CODE

   /etc/init.d/access-point stop

6. Copy the current file access-point and save it in a different location.
7. Remove the file access-point.
8. Copy the provided file access-point to the folder /opt/nexus/access-point/bin.

9. Set the correct permissions:

   Set permissions

   CODE

   chown pwuser:pwuser /opt/nexus/access-point/bin/access-point

10. Start the access point:

    Start access point

    CODE

    /etc/init.d/access-point start

11. Make sure that everything works and also verify system logs to check for any anomalies.

This instruction describes how to resolve a phishing vulnerability in Digital Access 6.0.2.

The needed file can be accessed here: https://support2.nexusgroup.com/Release/?sub=/SSO%20Vulnerability%20fix%20-%20DA-282/6.0.2&cat=Nexus%20Hybrid%20Access%20Gateway

1. Move the provided file access-point-6.0.2-sso-fix.tar to the virtual appliance. 
2. ssh into the machine.
3. Exit from the bash menu and elevate the prompt (use, for example, sudo su - )

4. Stop the access point:

   Stop access point

   CODE

   docker exec orchestrator hagcli -s access-point -o stop

5. Save the current access point as backup:

   Save current access point

   CODE

   docker save repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.2.26514 -o /home/agadmin/access-point-6.0.2-original.tar

6. Remove the old image:

   Remove old image

   CODE

   docker image rm -f  repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.2.26514

7. Load the new image (assuming it is in /home/agadmin):

   Load new image

   CODE

   docker load -i /home/agadmin/access-point-6.0.2-sso-fix.tar

8. Verify that it worked:

   1. Verify image

      CODE

      docker image ls | grep access

   2. This should produce a return output similar to this:

      repo.nexusgroup.com/smartid-digitalaccess/access-point           6.0.2.26514         58d0c3e7f973        13 hours ago        495MB

9. Start the new access point:

   Start access point

   CODE

   docker exec orchestrator hagcli -s access-point -o start

10. Verify that the access point starts:

    1. Verify that access point starts

       CODE

       docker ps

    2. There should be an entry like this:

       d47d2e9943b9        repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.2.26514           "/run-service.sh"        3 seconds ago       Up 2 seconds (health: starting)                       access-point

This instruction describes how to resolve a phishing vulnerability in Digital Access 6.0.3 and 6.0.4.

• The needed file for 6.0.4 can be accessed here: https://support2.nexusgroup.com/Release/?sub=/SSO%20Vulnerability%20fix%20-%20DA-282/6.0.4&cat=Nexus%20Hybrid%20Access%20Gateway
• The needed file for 6.0.3 can be accessed here: https://support2.nexusgroup.com/Release/?sub=/SSO%20Vulnerability%20fix%20-%20DA-282/6.0.3&cat=Nexus%20Hybrid%20Access%20Gateway

1. Move the provided file access-point-6.0.4-sso-fix.tar or access-point-6.0.3-sso-fix.tar to the virtual appliance. 
2. ssh into the machine.
3. Exit from the bash menu and elevate the prompt (use, for example, sudo su - )

4. Stop the access point:

   Stop access point

   CODE

   docker exec orchestrator hagcli -s access-point -o stop

5. Save the current access point as backup:

   Save current access point

   CODE

   docker save repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.4.44985 -o /home/agadmin/access-point-6.0.4-original.tar

6. Remove the old image:

   Remove old image

   CODE

   docker image rm -f  repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.4.44985

7. Load the new image (assuming it is in /home/agadmin):

   Load new image

   CODE

   docker load -i /home/agadmin/access-point-6.0.4-sso-fix.tar

8. Verify that it worked:

   1. Verify image

      CODE

      docker image ls | grep access

   2. This should produce a return output similar to this:

      repo.nexusgroup.com/smartid-digitalaccess/access-point           6.0.4.44985         58d0c3e7f973        13 hours ago        495MB

9. Start the new access point:

   Start access point

   CODE

   docker exec orchestrator hagcli -s access-point -o start

10. Verify that the access point starts:

    1. Verify that access point starts

       CODE

       docker ps

    2. There should be an entry like this:

       d47d2e9943b9        repo.nexusgroup.com/smartid-digitalaccess/access-point:6.0.4.44985           "/run-service.sh"        3 seconds ago       Up 2 seconds (health: starting)                       access-point