graysignal/cve-2024-24919-check-point-remote-access-vpnScan for and exploit CVE-2024-24919 in Check Point Security Gateways, an unauthenticated arbitrary file read that can expose credentials and lead to remote code execution.
CVE-2024-24919 is an unauthenticated arbitrary file read vulnerability that can be treated nothing less than a full unauthenticated RCE. An attacker can read any sensitive files located on the affected appliance with superuser access. An attacker can retrieve the contents of the ntds.dit or /etc/password file and can use them login to systems, and if the Security Gateway allows password only authentication, the attacker may use the cracked passwords to authenticate.
Affected product and versions: CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Spark Appliances R77.20 (EOL), R77.30 (EOL), R80.10 (EOL), R80.20 (EOL), R80.20.x, R80.20SP (EOL), R80.30 (EOL), R80.30SP (EOL), R80.40 (EOL), R81, R81.10, R81.10.x, R81.20
Usage: python3 scanner.py -i <Target_IP>
Usage: python3 exploit.py -i <Target_IP>
Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited. I am not responsible for any misuse or damage caused by this script.
References: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/
