Skip to content
KitploitKITPLOIT
أدواتالمدونة
إرسال
أدواتالمدونة
إرسال

أدوات الاختراق واختبار الاختراق والأمن السيبراني لترسانتك الأمنية!

Kitploit هو دليل لأدوات الاختراق والأمن السيبراني واختبار الاختراق. اكتشف آخر تحديثات المشاريع للعثور على الثغرات وتحليل الأنظمة وأتمتة الاختبارات وتعزيز أمنك.

··الخلاصات·اتصال·الخصوصية·© 2026 Kitploit

دليل الأدوات

الفئات

عرض جميع الفئات
Loading categories
Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation — Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation. | Kitploit
أدوات/GitHubGitHub/zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation
Vulnerability AnalysisNetwork ForensicsWeb SecurityNetwork SecurityDigital ForensicsThreat IntelligenceIntrusion DetectionLearning & EducationIncident Response
Log Analysis
GitHubzedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation

Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation

عرض المستودع
1منذ 28 أياملم تتم المراجعة بعد

الأكثر شعبية

عرض الكل →

اكتشف الأدوات الأكثر استخدامًا من قبل مجتمعنا.

استكشف جميع الأدوات

تصفح مجموعتنا من الأدوات

عرض جميع الأدوات →

حول

Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation.

مشاركة
المحتوى غير متوفر باللغة المطلوبة. عرض النسخة الإنجليزية.

Read on Medium

Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt

📌 Executive Summary

On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway (CP-Spark-Gateway-01, IP: 172.16.20.146). The external attacker, operating from IP 203.160.68.12, attempted to exploit CVE-2024-24919 (an Arbitrary File Read vulnerability) using a crafted HTTP POST request directed at the /clients/MyCRL endpoint with a Directory Traversal payload ().

aCSHELL/../../../../../../../../etc/passwd

Following a thorough Incident Response investigation across the SIEM, Firewall logs, OS logs, and Web Access logs, it was established that while the initial file read for /etc/passwd succeeded (returning HTTP status 200 with 1256 bytes of local system user metadata), subsequent lateral or escalation attempts (such as targeting /etc/shadow) were blocked (403 Forbidden). Furthermore, system audits and terminal log reviews confirmed an absence of post-exploitation activity, such as remote code execution, reverse shells, or unauthorized user account creation.

🔍 Investigation Findings & Evidence

1. SIEM Alert & Asset Vulnerability Mapping

  • Target Asset: Check Point Security Gateway (172.16.20.146)
  • Detection Trigger: SIEM Rule SOC287 (Event ID 263) for CVE-2024-24919.
  • Payload Structure: Malicious HTTP POST request containing aCSHELL/../../../../../../../../etc/passwd.

SIEM Alert Details

(Above: Asset vulnerability mapping and identification associated with CVE-2024-24919)

2. Firewall Traffic & Event History

  • Review of the firewall traffic and operational history around the incident timeframe (03:12 PM - 03:30 PM).

Firewall Logs

3. Web Access Log Analysis (/var/log/access.log)

  • Successful Compromise Vector: The request to read /etc/passwd returned an HTTP 200 OK status, confirming data exposure of system account details.
  • Failed Escalation: A subsequent attempt by a related external scanner (203.160.68.13) targeted /etc/shadow and was successfully rejected with an HTTP 403 Forbidden response.
  • Background Noise Verification: Concurrent entries from internal IP addresses (192.168.x.x, 10.x.x.x, 172.16.x.x) performing standard HTTP requests were verified as routine corporate network activity completely unrelated to the external intrusion.

Access Logs

(Above: Raw web access logs displaying the successful LFI execution alongside blocked access attempts)

4. Asset Tagging & Threat Intelligence

  • Verification of the asset configuration and the attacker's source IP address (203.160.68.12) against threat intelligence platforms.

Asset Tagging Threat Intel

(Above: VirusTotal reputation check confirming malicious/suspicious attribution)

🛡️ Remediation & Recommendations

  • Immediate Patching: Apply the official Check Point hotfix or firmware upgrade to permanently remediate CVE-2024-24919.
  • Perimeter Blocking: Enforce firewall rules to block traffic originating from malicious external source IP 203.160.68.12 (AS 10099 - China Unicom Global).
  • Credential Hygiene: Perform proactive password resets for the standard service and user accounts identified within the exposed configuration file.
تنزيل الأداة