CERT Alert - Vulnerability CVE-2024-24919 affecting Check Point Security Gateways

Critical Check Point 0-day worse than initially thought, exploited since April

[This blog will be updated as the situation evolves]

Update 1, 30/05/2024

Following the release of Check Point's advisory on the CVE-2024-24919 0-day vulnerability, some security companies released further intelligence about this flaw. First, Mnemonic stated that they detected exploitation attempts against their customers' environments as early as April 30 (compared to May 24 initially mentioned by Check Point). 

Vulnerability researchers confirm that the vulnerability is critical as it is easy to exploit remotely since it doesn't require user interaction or any privileges on attacked Check Point security gateways with Remote Access VPN and Mobile Access enabled.

Exploiting CVE-2024-24919 allegedly enables threat actors to enumerate and extract password hashes for all local accounts, and in particular the account used to connect to Active Directory. Mnemonic saw threat actors extracting "ntds.dit", a database that stores Active Directory data on users, groups, security descriptors, and password hashes, from compromised customers within 2-3 hours. It is also believed that the attackers exploited the flaw to collect information allowing them to move laterally within the victim's network and misuse Visual Studio Code to tunnel malicious traffic. WatchTowr published a technical analysis of the vulnerability indicating that the vendor was downplaying the severity of CVE-2024-24919. Indeed, they compared a vulnerable and patched system to identify the flaw and managed to do so in less than two days. They discovered that it was in fact a path traversal leading to an arbitrary file read, which could allow a threat actor to access specific information on compromised gateways, potentially enabling them to retrieve password hashes and other sensitive data.

As a consequence of these findings, we have decided to raise the threat level of this advisory to 4 out of 5. Indeed, the attack surface is huge, with dozens of thousands of instances of Check Point currently exposed on the Internet, with a yet unknown number still vulnerable.

However, the recommendation remains the same, and organizations running the affected instance should:

• immediately patch their systems,
• deploy the Check Point IPS signature blocking the attack,
• hunt for suspicious past behavior indicating a possible compromise attempt (using IOCs such the ones shared by Check Point here on May 30, abnormal logins or local users, etc.), ideally since beginning of April and at least since April 30. Reminder: the vulnerable endpoint is "https://<ip>/clients/MyCRL" and anomalous requests toward it should be checked to detect exploitation activity.

If you suspect your instance to be compromised, you may reach out to our CSIRT teams, on top of warning Check Point's support, that will guide you in what to look for in your investigations.