Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation — Updated!
Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation.
Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt
📌 Executive Summary
On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway (CP-Spark-Gateway-01, IP: 172.16.20.146). The external attacker, operating from IP 203.160.68.12, attempted to exploit CVE-2024-24919 (an Arbitrary File Read vulnerability) using a crafted HTTP POST request directed at the /clients/MyCRL endpoint with a Directory Traversal payload (aCSHELL/../../../../../../../../etc/passwd).
Following a thorough Incident Response investigation across the SIEM, Firewall logs, OS logs, and Web Access logs, it was established that while the initial file read for /etc/passwd succeeded (returning HTTP status 200 with 1256 bytes of local system user metadata), subsequent lateral or escalation attempts (such as targeting /etc/shadow) were blocked (403 Forbidden). Furthermore, system audits and terminal log reviews confirmed an absence of post-exploitation activity, such as remote code execution, reverse shells, or unauthorized user account creation.
🔍 Investigation Findings & Evidence
1. SIEM Alert & Asset Vulnerability Mapping
- Target Asset: Check Point Security Gateway (
172.16.20.146) - Detection Trigger: SIEM Rule
SOC287(Event ID263) for CVE-2024-24919. - Payload Structure: Malicious HTTP POST request containing
aCSHELL/../../../../../../../../etc/passwd.
(Above: Asset vulnerability mapping and identification associated with CVE-2024-24919)
2. Firewall Traffic & Event History
- Review of the firewall traffic and operational history around the incident timeframe (03:12 PM - 03:30 PM).
3. Web Access Log Analysis (/var/log/access.log)
- Successful Compromise Vector: The request to read
/etc/passwdreturned an HTTP200 OKstatus, confirming data exposure of system account details. - Failed Escalation: A subsequent attempt by a related external scanner (
203.160.68.13) targeted/etc/shadowand was successfully rejected with an HTTP403 Forbiddenresponse. - Background Noise Verification: Concurrent entries from internal IP addresses (
192.168.x.x,10.x.x.x,172.16.x.x) performing standard HTTP requests were verified as routine corporate network activity completely unrelated to the external intrusion.
(Above: Raw web access logs displaying the successful LFI execution alongside blocked access attempts)
4. Asset Tagging & Threat Intelligence
- Verification of the asset configuration and the attacker's source IP address (
203.160.68.12) against threat intelligence platforms.
(Above: VirusTotal reputation check confirming malicious/suspicious attribution)
🛡️ Remediation & Recommendations
- Immediate Patching: Apply the official Check Point hotfix or firmware upgrade to permanently remediate CVE-2024-24919.
- Perimeter Blocking: Enforce firewall rules to block traffic originating from malicious external source IP
203.160.68.12(AS 10099 - China Unicom Global). - Credential Hygiene: Perform proactive password resets for the standard service and user accounts identified within the exposed configuration file.