Скачать или смотреть SA - SOC287-263 - Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919]

Continuing with the Security Analyst Path, we tackle an HIHJ alert for an Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919]. Was this actual exploitation or just a false alarm?

⭐ CVE-2024-24919 is a zero-day arbitrary file read in Check Point Security Gateways.
EventID: 263
Event Time: Jun, 06, 2024, 03:12 PM
Rule: SOC287 - Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919]
Level: Security Analyst
Hostname: CP-Spark-Gateway-01
Destination IP Address: 172.16.20.146
Source IP Address: 203.160.68.12
HTTP Request Method: POST
Requested URL: 172.16.20.146/clients/MyCRL
Request: aCSHELL/../../../../../../../../../../etc/passwd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0
Alert Trigger Reason: Characteristics exploit pattern Detected on Request, indicative exploitation of the CVE-2024-24919.
Device Action: Allowed


Items in question:
https://www.virustotal.com/gui/ip-add...
https://talosintelligence.com/reputat...
https://otx.alienvault.com/indicator/...

NOTES:
https://support.checkpoint.com/result...
https://www.greynoise.io/blog/whats-g...
https://censys.com/blog/cve-2024-24919
https://labs.watchtowr.com/check-poin...
https://www.mnemonic.io/resources/blo...