๐ก๏ธ Security Incident Report: CVE-2024-24919 Exploitation Attempt
Date: June 6, 2024
Time: 03:12 PM
Event ID: 263
Rule Triggered: SOC287 - Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919]
Analyst Level: Security Analyst
Incident Severity: High
Escalation Status: Escalated to Level 2
โธป
๐ Summary
At approximately 03:12 PM on June 6, 2024, an alert was triggered on CP-Spark-Gateway-01 indicating potential exploitation of CVE-2024-24919, a zero-day arbitrary file read vulnerability in Check Point Security Gateways.
โ ๏ธ Threat Details
โข Source IP Address: 203.160.68.12
โข Reputation: Malicious โ flagged by multiple threat intelligence vendors including VirusTotal.
โข Associated with known exploit activity and high-risk behavior patterns.
โข Destination IP Address: 172.16.20.146 (Internal asset - CP-Spark-Gateway-01)
โข HTTP Method: POST
โข Requested URL: http://172.16.20.146/clients/MyCRL
โข Payload: aCSHELL/../../../../../../../../../../etc/passwd
โข User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0
โข HTTP Response Code: 200 OK
โข Indicates successful execution of the payload and retrieval of the /etc/passwd file โ confirming unauthorized file read.
๐ก๏ธ Security Response Actions
โข โ
Endpoint Contained:
โข The affected host CP-Spark-Gateway-01 has been isolated from the network to prevent further compromise and lateral movement.
โข โ
Indicators of Compromise (IoCs) Logged and Shared:
โข Source IP: 203.160.68.12
โข URL Pattern: /clients/MyCRL with traversal strings
โข Payload Signature: Path traversal targeting /etc/passwd
โข User-Agent Pattern: Consistent with other exploitation attempts of CVE-2024-24919
โข โ
Incident Escalation:
โข Case has been escalated to Level 2 SOC Analysts for deep-dive analysis, log correlation, and potential threat actor attribution.
โธป
๐ Next Steps
1. Level 2 Review โ In-depth analysis of gateway logs and correlated traffic.
2. Patch Validation โ Verify if vendor patches for CVE-2024-24919 have been applied; expedite where necessary.
3. Forensic Snapshot โ Take system image of CP-Spark-Gateway-01 before remediation.
4. Network Sweep โ Search for similar payloads or source IP activity across the environment.
5. Update Firewall/IPS Signatures โ Block listed source and tighten payload pattern rules.