Huge Surge in Attacks Exploiting Check Point VPN Zero-Day Vulnerability

Test Level published an advisory referring to a main vulnerability, CVE-2024-24919, which has since viewed a surge in exploitation attempts.

The vulnerability, rated with a CVSS fetch of 8.6, lets in attackers to accept entry to sensitive info on the Security Gateway, presumably ensuing in lateral high-tail and arena admin privileges.

CVE-2024-24919– The Vulnerability

This vulnerability lets in attackers to accept entry to info and directories saved start air the web root folder.

The affirm exploit contains sending a crafted POST demand to the server, which runs as root. This lets within the attacker to rob any file on the filesystem.

The exploit, as reverse-engineered by every Test Level and watchTowr labs, seems treasure this:

POST /clients/MyCRL HTTP/1.1  Host:   Content-Length: 39  aCSHELL/../../../../../../../etc/shadow

Preliminary Discovery and Advisory

Test Level’s advisory, even supposing considerably imprecise, highlighted the severity of the vulnerability.

The advisory worthy that exploiting this vulnerability may maybe maybe maybe well discontinuance in having access to sensitive info and presumably lead to arena admin privileges.

Evidently the attacks within the wild had been occurring since April 7, 2024.

Two days after the advisory, on Could well 30, 2024, watchTowr labs published a detailed write-up, at the side of a working proof of thought.

The Cybersecurity and Infrastructure Security Company (CISA) added CVE-2024-24919 to its Identified Exploited Vulnerabilities listing on the the same day. By Could well 31, 2024, exploitation attempts were being seen globally.

Observations and Files

Sift, a cybersecurity monitoring tool, tagged the discipline like a flash. The predominant exploit are attempting change into logged on Could well 30, 2024, even supposing it change into a non-working exploit.

The predominant worthwhile exploitation are attempting change into recorded on Could well 31, 2024, at around 9:30 AM UTC. The payload ancient in these attempts change into the same to the proof of thought published by watchTowr labs.

A handbook search of honeypot info revealed that the oldest exploit attempts started on Could well 30, 2024, at about 5 PM UTC.

These attempts, however, did now not work, indicating that attackers were quiet refining their systems.

The predominant valid exploitation change into seen on Could well 31, 2024, from a Original York-essentially based entirely IP tackle, Grey Noise acknowledged.

POST /clients/MyCRL HTTP/1.1  Host:   User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36  Accept-Encoding: gzip, deflate  Accept: */*  Connection: keep-alive  Content-Length: 38  /clients/MyCRL/../../../..//etc/passwd

Top Exploited Paths

As of June 4, 2024, the discontinuance-10 listing of plausibly-working payloads seen contains:

1. ../../../../../../../etc/fstab – 4805 attempts
2. ../../../../../../../etc/shadow – 2453 attempts
3. ../../../../../../../sysimg/CPwrapper/SU/Merchandise.conf – 980 attempts
4. ../../../../../../../config/db/preliminary – 959 attempts
5. ../../../../../../../etc/passwd – 508 attempts
6. ../../../../../../../house/*/.ssh/authorized_keys – 202 attempts
7. ../../../../../../../opt/checkpoint/conf/ – 166 attempts
8. ../../../../../../../etc/ssh/sshd_config – 165 attempts
9. ../../../../../../../etc/vpn/vpn.conf – 163 attempts
10. ../../../../../../../house/*/.ssh/id_rsa – 161 attempts

The fast elevate in exploitation attempts following the public disclosure of CVE-2024-24919 underscores the significant want for organizations to patch their systems promptly.

With a public proof of thought accessible and exploitation ramping up, all affected entities must educate the specified patches to mitigate this severe vulnerability.