## https://sploitus.com/exploit?id=7A0CCD14-31AB-5714-98B7-BCA53D2A0E81
[]()
# Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt
## ๐ Executive Summary
On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway (`CP-Spark-Gateway-01`, IP: `172.16.20.146`). The external attacker, operating from IP `203.160.68.12`, attempted to exploit **CVE-2024-24919** (an Arbitrary File Read vulnerability) using a crafted HTTP POST request directed at the `/clients/MyCRL` endpoint with a Directory Traversal payload (`aCSHELL/../../../../../../../../etc/passwd`).
Following a thorough Incident Response investigation across the SIEM, Firewall logs, OS logs, and Web Access logs, it was established that while the initial file read for `/etc/passwd` succeeded (returning HTTP status `200` with 1256 bytes of local system user metadata), subsequent lateral or escalation attempts (such as targeting `/etc/shadow`) were blocked (`403 Forbidden`). Furthermore, system audits and terminal log reviews confirmed an absence of post-exploitation activity, such as remote code execution, reverse shells, or unauthorized user account creation.
---
## ๐ Investigation Findings & Evidence
### 1. SIEM Alert & Asset Vulnerability Mapping
* **Target Asset:** Check Point Security Gateway (`172.16.20.146`)
* **Detection Trigger:** SIEM Rule `SOC287` (Event ID `263`) for CVE-2024-24919.
* **Payload Structure:** Malicious HTTP POST request containing `aCSHELL/../../../../../../../../etc/passwd`.
*(Above: Asset vulnerability mapping and identification associated with CVE-2024-24919)*
---
### 2. Firewall Traffic & Event History
* Review of the firewall traffic and operational history around the incident timeframe (03:12 PM - 03:30 PM).
---
### 3. Web Access Log Analysis (`/var/log/access.log`)
* **Successful Compromise Vector:** The request to read `/etc/passwd` returned an HTTP `200 OK` status, confirming data exposure of system account details.
* **Failed Escalation:** A subsequent attempt by a related external scanner (`203.160.68.13`) targeted `/etc/shadow` and was successfully rejected with an HTTP `403 Forbidden` response.
* **Background Noise Verification:** Concurrent entries from internal IP addresses (`192.168.x.x`, `10.x.x.x`, `172.16.x.x`) performing standard HTTP requests were verified as routine corporate network activity completely unrelated to the external intrusion.
*(Above: Raw web access logs displaying the successful LFI execution alongside blocked access attempts)*
---
### 4. Asset Tagging & Threat Intelligence
* Verification of the asset configuration and the attacker's source IP address (`203.160.68.12`) against threat intelligence platforms.
*(Above: VirusTotal reputation check confirming malicious/suspicious attribution)*
---
## ๐ก๏ธ Remediation & Recommendations
* **Immediate Patching:** Apply the official Check Point hotfix or firmware upgrade to permanently remediate **CVE-2024-24919**.
* **Perimeter Blocking:** Enforce firewall rules to block traffic originating from malicious external source IP `203.160.68.12` (AS 10099 - China Unicom Global).
* **Credential Hygiene:** Perform proactive password resets for the standard service and user accounts identified within the exposed configuration file.