Skip to content
KitploitKITPLOIT
उपकरणब्लॉग
जमा करें
उपकरणब्लॉग
जमा करें

हैकिंग, पेनटेस्ट और साइबर सुरक्षा उपकरण आपके सुरक्षा शस्त्रागार के लिए!

Kitploit हैकिंग, साइबर सुरक्षा और पेंटेस्टिंग टूल्स की एक निर्देशिका है। कमजोरियों को खोजने, सिस्टम का विश्लेषण करने, परीक्षण को स्वचालित करने और अपनी सुरक्षा को मजबूत करने के लिए नवीनतम प्रोजेक्ट अपडेट खोजें।

··फ़ीड·संपर्क·गोपनीयता·© 2026 Kitploit

टूल निर्देशिका

श्रेणियाँ

सभी श्रेणियाँ देखें
Loading categories
Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation — Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation. | Kitploit
उपकरण/GitHubGitHub/zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation
Vulnerability AnalysisNetwork ForensicsWeb SecurityNetwork SecurityDigital ForensicsThreat IntelligenceIntrusion DetectionLearning & EducationIncident Response
Log Analysis
GitHubzedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation

Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation

रिपॉजिटरी देखें
128 दिन पहलेअभी तक समीक्षित नहीं

सबसे लोकप्रिय

सभी देखें →

हमारे समुदाय द्वारा सबसे अधिक उपयोग किए जाने वाले उपकरण खोजें।

सभी उपकरण खोजें

हमारे उपकरणों का संग्रह ब्राउज़ करें

सभी उपकरण देखें →

विवरण

Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation.

साझा करें
अनुरोधित भाषा में सामग्री उपलब्ध नहीं है। अंग्रेज़ी संस्करण दिखाया जा रहा है।

Read on Medium

Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt

📌 Executive Summary

On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway (CP-Spark-Gateway-01, IP: 172.16.20.146). The external attacker, operating from IP 203.160.68.12, attempted to exploit CVE-2024-24919 (an Arbitrary File Read vulnerability) using a crafted HTTP POST request directed at the /clients/MyCRL endpoint with a Directory Traversal payload ().

aCSHELL/../../../../../../../../etc/passwd

Following a thorough Incident Response investigation across the SIEM, Firewall logs, OS logs, and Web Access logs, it was established that while the initial file read for /etc/passwd succeeded (returning HTTP status 200 with 1256 bytes of local system user metadata), subsequent lateral or escalation attempts (such as targeting /etc/shadow) were blocked (403 Forbidden). Furthermore, system audits and terminal log reviews confirmed an absence of post-exploitation activity, such as remote code execution, reverse shells, or unauthorized user account creation.

🔍 Investigation Findings & Evidence

1. SIEM Alert & Asset Vulnerability Mapping

  • Target Asset: Check Point Security Gateway (172.16.20.146)
  • Detection Trigger: SIEM Rule SOC287 (Event ID 263) for CVE-2024-24919.
  • Payload Structure: Malicious HTTP POST request containing aCSHELL/../../../../../../../../etc/passwd.

SIEM Alert Details

(Above: Asset vulnerability mapping and identification associated with CVE-2024-24919)

2. Firewall Traffic & Event History

  • Review of the firewall traffic and operational history around the incident timeframe (03:12 PM - 03:30 PM).

Firewall Logs

3. Web Access Log Analysis (/var/log/access.log)

  • Successful Compromise Vector: The request to read /etc/passwd returned an HTTP 200 OK status, confirming data exposure of system account details.
  • Failed Escalation: A subsequent attempt by a related external scanner (203.160.68.13) targeted /etc/shadow and was successfully rejected with an HTTP 403 Forbidden response.
  • Background Noise Verification: Concurrent entries from internal IP addresses (192.168.x.x, 10.x.x.x, 172.16.x.x) performing standard HTTP requests were verified as routine corporate network activity completely unrelated to the external intrusion.

Access Logs

(Above: Raw web access logs displaying the successful LFI execution alongside blocked access attempts)

4. Asset Tagging & Threat Intelligence

  • Verification of the asset configuration and the attacker's source IP address (203.160.68.12) against threat intelligence platforms.

Asset Tagging Threat Intel

(Above: VirusTotal reputation check confirming malicious/suspicious attribution)

🛡️ Remediation & Recommendations

  • Immediate Patching: Apply the official Check Point hotfix or firmware upgrade to permanently remediate CVE-2024-24919.
  • Perimeter Blocking: Enforce firewall rules to block traffic originating from malicious external source IP 203.160.68.12 (AS 10099 - China Unicom Global).
  • Credential Hygiene: Perform proactive password resets for the standard service and user accounts identified within the exposed configuration file.
टूल डाउनलोड करें