Skip to content
KitploitKITPLOIT
ИнструментыБлог
Отправить
ИнструментыБлог
Отправить

Инструменты для хакинга, пентеста и кибербезопасности — ваш арсенал защиты!

Kitploit — это каталог инструментов для хакинга, кибербезопасности и пентестинга. Находите последние обновления проектов для поиска уязвимостей, анализа систем, автоматизации тестирования и усиления вашей безопасности.

··Ленты·Контакты·Конфиденциальность·© 2026 Kitploit

Каталог инструментов

Категории

Все категории
Loading categories
Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation — Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation. | Kitploit
Инструменты/GitHubGitHub/zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation
Vulnerability AnalysisNetwork ForensicsWeb SecurityNetwork SecurityDigital ForensicsThreat IntelligenceIntrusion DetectionLearning & EducationIncident Response
Log Analysis
GitHubzedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitation

Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation

Репозиторий
128 дней назадЕщё не проверено

Популярное

Смотреть все →

Откройте для себя самые используемые инструменты нашего сообщества.

Изучить все инструменты

Просмотрите нашу коллекцию инструментов

Смотреть все инструменты →

Описание

Incident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation.

Поделиться
Контент недоступен на запрошенном языке. Показываем английскую версию.

Read on Medium

Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt

📌 Executive Summary

On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway (CP-Spark-Gateway-01, IP: 172.16.20.146). The external attacker, operating from IP 203.160.68.12, attempted to exploit CVE-2024-24919 (an Arbitrary File Read vulnerability) using a crafted HTTP POST request directed at the /clients/MyCRL endpoint with a Directory Traversal payload ().

aCSHELL/../../../../../../../../etc/passwd

Following a thorough Incident Response investigation across the SIEM, Firewall logs, OS logs, and Web Access logs, it was established that while the initial file read for /etc/passwd succeeded (returning HTTP status 200 with 1256 bytes of local system user metadata), subsequent lateral or escalation attempts (such as targeting /etc/shadow) were blocked (403 Forbidden). Furthermore, system audits and terminal log reviews confirmed an absence of post-exploitation activity, such as remote code execution, reverse shells, or unauthorized user account creation.

🔍 Investigation Findings & Evidence

1. SIEM Alert & Asset Vulnerability Mapping

  • Target Asset: Check Point Security Gateway (172.16.20.146)
  • Detection Trigger: SIEM Rule SOC287 (Event ID 263) for CVE-2024-24919.
  • Payload Structure: Malicious HTTP POST request containing aCSHELL/../../../../../../../../etc/passwd.

SIEM Alert Details

(Above: Asset vulnerability mapping and identification associated with CVE-2024-24919)

2. Firewall Traffic & Event History

  • Review of the firewall traffic and operational history around the incident timeframe (03:12 PM - 03:30 PM).

Firewall Logs

3. Web Access Log Analysis (/var/log/access.log)

  • Successful Compromise Vector: The request to read /etc/passwd returned an HTTP 200 OK status, confirming data exposure of system account details.
  • Failed Escalation: A subsequent attempt by a related external scanner (203.160.68.13) targeted /etc/shadow and was successfully rejected with an HTTP 403 Forbidden response.
  • Background Noise Verification: Concurrent entries from internal IP addresses (192.168.x.x, 10.x.x.x, 172.16.x.x) performing standard HTTP requests were verified as routine corporate network activity completely unrelated to the external intrusion.

Access Logs

(Above: Raw web access logs displaying the successful LFI execution alongside blocked access attempts)

4. Asset Tagging & Threat Intelligence

  • Verification of the asset configuration and the attacker's source IP address (203.160.68.12) against threat intelligence platforms.

Asset Tagging Threat Intel

(Above: VirusTotal reputation check confirming malicious/suspicious attribution)

🛡️ Remediation & Recommendations

  • Immediate Patching: Apply the official Check Point hotfix or firmware upgrade to permanently remediate CVE-2024-24919.
  • Perimeter Blocking: Enforce firewall rules to block traffic originating from malicious external source IP 203.160.68.12 (AS 10099 - China Unicom Global).
  • Credential Hygiene: Perform proactive password resets for the standard service and user accounts identified within the exposed configuration file.
Скачать инструмент