CVE-2024-24919

What it actually does

This vulnerability is an unauthenticated information disclosure flaw in internet-facing Check Point Security Gateways when Remote Access VPN or Mobile Access Software Blades are enabled. A remote attacker can send crafted requests to the gateway and read sensitive files or configuration data from the appliance without valid credentials. The flaw does not directly provide code execution, but exposed files can contain local account data, VPN configuration, certificates, LDAP or directory integration details, session material, or other secrets that can enable credential theft and follow-on access.

Why it matters to the business

Compromise of an affected gateway can expose the credentials and configuration material used to protect remote access into the organization. Because these devices often sit at the network perimeter and broker VPN access, exploitation can lead to unauthorized remote access, lateral movement, data theft, and ransomware deployment. This issue is listed in CISA KEV, has been used in ransomware campaigns, has extremely high EPSS likelihood, and had a CISA remediation deadline of 2024-06-20, so any unpatched internet-exposed instance should be treated as high-priority and potentially already targeted.

How an attack unfolds

An attacker scans the internet for Check Point Quantum, CloudGuard Network Security, or Quantum Spark gateways exposing Remote Access VPN or Mobile Access services. The attacker then sends a crafted unauthenticated request to a vulnerable endpoint, commonly associated with the VPN web interface, to read files from the gateway. Retrieved files may include operating system account files, Check Point configuration files, VPN user information, or authentication integration secrets. The attacker analyzes the disclosed data for reusable credentials, password hashes, service account secrets, certificates, or topology information. If useful credentials are recovered, the attacker attempts VPN authentication or other remote access, often from new infrastructure, and may then move laterally inside the network, establish persistence, exfiltrate data, or deploy ransomware.

How to fix it

Apply the Check Point security fix or vendor-recommended hotfix for CVE-2024-24919 to all affected Quantum Security Gateway, CloudGuard Network Security, and Quantum Spark appliances. If an exact fixed version is not available in inventory data, upgrade to the latest vendor-supported release or Jumbo Hotfix Accumulator that explicitly includes the fix, following Check Point guidance. Where Remote Access VPN or Mobile Access is not required, disable the relevant Software Blade or remove internet exposure. Where it is required, restrict access to trusted source ranges where feasible, enforce MFA, and ensure local VPN accounts are not used without strong controls. Because exploitation may disclose credentials and secrets, rotate local gateway accounts, VPN user passwords, LDAP or directory bind credentials, shared secrets, API keys, and certificates that may have been stored on or accessible from the gateway. Revoke active VPN sessions and review all remote-access authentication after patching.

How to confirm the fix worked

Confirm every affected gateway is running a vendor-fixed build or hotfix level by checking the Check Point management console, gateway package inventory, and command-line hotfix/Jumbo Hotfix status. Validate that Remote Access VPN and Mobile Access exposure is intentional and limited. From an external vantage point, verify that only expected VPN services are reachable and that crafted traversal-style requests to the vulnerable endpoint no longer return file contents. Review configuration backups and asset inventory to ensure CloudGuard, Quantum, and Quantum Spark variants are included. After remediation, validate credential rotation, MFA enforcement, and termination of existing VPN sessions.

Typical attack path

1. Identify internet-facing Check Point Security Gateway, CloudGuard Network Security, Quantum Gateway, or Quantum Spark device with Remote Access VPN or Mobile Access enabled.
2. Send crafted unauthenticated requests to the vulnerable VPN/Mobile Access endpoint to read sensitive local files or configuration data.
3. Extract credentials, password hashes, certificates, LDAP bind details, VPN user information, or network topology from disclosed files.
4. Use recovered credentials or secrets to authenticate to VPN or related services.
5. Perform internal reconnaissance from the VPN foothold and attempt privilege escalation or lateral movement.
6. Exfiltrate data, establish persistence, or deploy ransomware if broader access is obtained.

How to detect it

Review gateway, VPN, web access, firewall, and centralized SIEM logs for requests to VPN/Mobile Access endpoints that contain path traversal patterns or attempts to read operating system and Check Point configuration files. Focus on unauthenticated requests to /clients/MyCRL and similar VPN web paths, especially requests containing ../ sequences or references to /etc/passwd, /etc/shadow, Check Point installation paths, user databases, certificates, or configuration files. Correlate suspicious requests with response sizes, HTTP 200 responses, and follow-on VPN authentication from the same source IP, nearby infrastructure, or unusual geographies. Review Check Point logs such as VPN authentication logs, Mobile Access logs, HTTPD/web logs, system logs, and management logs for anomalous remote-access activity. Look for successful VPN logins by dormant accounts, local accounts, service accounts, or accounts with impossible travel patterns after the first suspicious request. Because exploitation may only read files and leave limited host artifacts, network telemetry and historical access logs are especially important. If exploitation is suspected, preserve logs and gateway images where possible, rotate secrets, and investigate downstream authentication and lateral movement activity.

• /clients/MyCRL
• ../
• ..%2f
• %2e%2e%2f
• /etc/passwd
• /etc/shadow
• aCSHELL/../../
• CSHELL/../../
• /opt/CPsuite-
• /opt/CPshrd-
• /opt/CPsuite-R80
• /opt/CPsuite-R81
• /var/log/messages
• POST /clients/MyCRL
• GET /clients/MyCRL
• /clients/MyCRL.*../
• /clients/MyCRL.*etc/passwd
• /clients/MyCRL.*etc/shadow

What your security team should do

• Immediately identify all internet-facing Check Point gateways, CloudGuard Network Security deployments, and Quantum Spark devices with Remote Access VPN or Mobile Access enabled.
• Patch or apply the vendor hotfix on all affected devices; prioritize systems exposed to the internet because the vulnerability is in CISA KEV, actively exploited, and associated with ransomware activity.
• Assume exposed vulnerable gateways may have been queried and perform incident response-style log review before closing the issue.
• Rotate credentials and secrets that may reside on the gateway, including local users, VPN accounts, LDAP bind accounts, shared secrets, API keys, and relevant certificates.
• Revoke active VPN sessions and require reauthentication after patching and credential rotation.
• Enforce MFA for all remote-access users and disable unused local or legacy VPN accounts.
• Restrict Remote Access VPN and Mobile Access exposure to approved source networks where operationally possible.
• Hunt for suspicious requests to VPN endpoints, especially traversal-style requests to /clients/MyCRL and subsequent unusual VPN logins from unfamiliar IP addresses.
• Review remote-access authentication logs for successful logins using accounts that had not recently been active or that occur soon after suspicious gateway requests.
• Escalate any confirmed pre-patch exposure with suspicious requests or credential use to incident response because disclosed secrets can enable delayed follow-on compromise.