Post cover image
Figure 1: High-priority SIEM alert (SOC287) indicating unauthorized external probing and CVE-2024–24919 exploitation attempts targeting the Check Point Gateway

August 1, 2026

Incident Analysis & Response: Check Point Security Gateway CVE-2024–24919 LFI Exploitation

Introduction & Overview

By Ben Rubin (Zedocun)

2 min read

Introduction & Overview

As an Incident Response (IR) analyst, encountering vulnerabilities in perimeter security devices demands rapid, methodical triage. In this incident case study, we analyze a real-world exploitation attempt targeting a Check Point Security Gateway via CVE-2024–24919 — a zero-day Arbitrary File Read vulnerability.

This post details the full lifecycle of the alert, from initial SIEM detection and raw web access log inspection to threat intelligence verification, showing how the attack was identified, scoped, and handled.

Phase 1: Alert Detection & Triage

The incident originated from a high-priority SIEM alert (SOC287) indicating suspicious activity hitting the Check Point Security Gateway.

  • Event ID: 263
  • Event Time: Jun, 06, 2024, 03:12 PM
  • Source IP Address: 203.160.68.12
  • Destination IP Address: 172.16.20.146 (CP-Spark-Gateway-01)
  • Initial Classification: True Positive (TP). The traffic was confirmed as an active, unauthorized external attack matching exploit patterns for CVE-2024–24919.
None

Phase 2: Threat Intelligence & Attribution

To understand the scope of the attacking entity, the source IP (203.160.68.12) was cross-referenced with threat intelligence feeds.

  • ASN/ISP: AS 10099 (China Unicom Global)
  • Community Score: Flagged as malicious across 8 security vendors (including Chong Lua Dao, CyRadar, GreyNoise, and Forcepoint ThreatSeeker).
None

Phase 3: Log Analysis & Investigation

To understand the nature of the request, we inspected the raw web access logs on the gateway (/var/log/access.log).

The attacker leveraged a POST request tailored to exploit CVE-2024–24919, utilizing Path Traversal to request sensitive system files.

None

Key Findings from the Logs:

  1. Target 1 (/etc/passwd): The attacker successfully extracted system metadata and user accounts, receiving an HTTP 200 OK status with a payload size of 1256 bytes.
  2. Target 2 (/etc/shadow): A subsequent attempt by IP 203.160.68.13 to access higher-privilege files was successfully blocked, returning an HTTP 403 Forbidden status code.

Phase 4: Firewall & Infrastructure Validation

Correlating the web logs with the firewall logs verified the connection flows and ports utilized during the attack lifecycle.

None

Indicators of Compromise (IOCs) & Tagging

The following indicators were extracted and tagged for tracking within the SOC environment:

None
  • 203.160.68.12 (IP Address) — External Attacker Source IP (China Unicom Global)
  • 172.16.20.146 (IP Address) — Target Check Point Gateway (CP-Spark-Gateway-01)
  • /etc/passwd (File Path) — Target of Successful LFI Extraction

MITRE ATT&CK Mapping

  • Tactic: Initial Access / Reconnaissance & Discovery
  • Technique: Exploit Public-Facing Application (T1190) — Targeting CVE-2024–24919.
  • Technique: Automated Exfiltration / Data from Local System (T1005) — Reading system files via LFI (/etc/passwd).

Conclusion & Remediation

This incident highlights the critical danger of unpatched perimeter appliances. Although the attacker successfully achieved Arbitrary File Read (exposing system user structures via /etc/passwd), the defense-in-depth posture prevented escalation, command execution, and lateral movement.

Required Remediation Steps:

  1. Isolate and patch the Check Point Security Gateway with the official vendor hotfix for CVE-2024–24919.
  2. Block attacker IP 203.160.68.12 and associated subnets across all perimeter firewalls.
  3. Escalate the incident to Tier 2 / Incident Response for deep-dive artifact preservation and credential rotation for exposed system accounts.