CVE-2024-24919: Check Point Security Gateways Zero-Day Vulnerability Explained

On May 28th, 2024, Check Point disclosed an arbitrary file read vulnerability affecting Check Point Security Gateways [1]. CVE-2024-24919 has a CVSS score of 8.6 (High) and allows adversaries to read sensitive files from vulnerable products with root privileges. If the certificate authentication is not enabled, adversaries may exploit CVE-2024-24919 for unauthenticated remote code execution. 

In this blog, we explained how the Check Point CVE-2024-24919 vulnerability works and how organizations can defend against CVE-2024-24919 attacks.

Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform

Check Point CVE-2024-24919 Vulnerability Explained

Check Point Security Gateways are used by organizations worldwide as a security barrier against various types of threats and unauthorized access to networked systems. On May 27th, 2024, Check Point saw a significant volume of malicious traffic targeting VPN devices. CVE-2024-24919 is a high-severity zero-day vulnerability affecting Check Point Security Gateways with remote Access VPN or Mobile Access Software Blades enabled. The vulnerability has a CVSS score of 8.6 (High) and can be exploited for arbitrary file read with a possibility of unauthenticated remote code execution. Due to ease of exploitability, organizations are advised to apply hot fixes to their vulnerable Check Point Security Gateway products.

How Check Point CVE-2024-24919 Exploit Works?

Check Point CVE-2024-24919 is an arbitrary file read vulnerability (CWE-200) that allows attackers to access and read sensitive files via path traversal. On its own, an arbitrary file read vulnerability would have a high severity score. However, CVE-2024-24919 allows attackers to access files with root privileges, increasing the severity. Adversaries can access critical files such as  "passwd" and "shadow" and harvest user credentials. If any multi-factor authentication is in place, attackers use harvested credentials for remote code execution.

The example HTTP POST request below exploits the CVE-2024-24919 vulnerability. 

How Picus Helps Simulate Check Point CVE-2024-24919 Attacks?

We also strongly suggest simulating the Check Point CVE-2024-24919 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as Log4Shell, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Check Point CVE-2024-24919 vulnerability exploitation attacks:

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Check Point CVE-2024-24919 vulnerability in preventive security controls. Currently, Picus Labs validated the following signatures for Check Point CVE-2024-24919 vulnerability:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Complete Security Validation Platform.

References

[1] "Preventative Hotfix for CVE-2024-24919 - Quantum Gateway Information Disclosure." Available: https://support.checkpoint.com/results/sk/sk182336