Cloud Management Gateway

Question

Hello,

Good evening, I have a question regarding CMG. We set up a CMG some time ago, and it’s been working fine. However, today, a cybersecurity team asked why the CMG Service URL (https://<cmgaliasname>.xyz.com) returns an HTTP Error 500 when accessed directly via edge or any browser. He mentioned that a 500 error indicates the request was accepted, but it was not formatted correctly, causing a backend crash and resulting in the error. He also noted that this could allow attackers to experiment with different inputs to trigger various error codes and potentially exploit the crash to compromise the server.

I’ve verified that there are no errors in SMS Proxy connector, CMGService logs where the CMG connection point is configured, and the CMG is healthy. No errors were found in the connection analyzer either. Additionally, the CMG server certificate remains valid for another 8 months.

Is it normal to encounter a 500 error when accessing the CMG URL from the public internet?

Thank you for your time and assistance in advance!

Answer 1

Hi,

Hope everything is going well.

Similar thread for your reference:

CMG URL in Browser expectation

Note: This is non-Microsoft link, just for your reference.

Feel free to contact me if you have any concerns/queries.

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

After the way you tag questions on Q&A is updated, for any "Microsoft Configuration Manager" related problem, you can tag it with "Microsoft Intune", and then "Microsoft Configuration Manager" as the child tag.

Answer 2

Hi,

Gotcha. Thank you for assisting me with this.

Thanks.