CVE-2024–24919: Full Exploitation Flow Explained (From Discovery to Domain Impact)

Overview

CVE-2024–24919 is a critical unauthenticated arbitrary file read vulnerability affecting Check Point Security Gateways. The flaw exists in the vpnd service and allows attackers to read any file on the underlying GAIA OS as root, without authentication.

What makes this vulnerability especially dangerous is that it is not caused by complex exploitation, but by weak input validation logic combined with high-privilege execution.

Phase 1: Target Discovery

Attackers begin by scanning the internet for exposed Check Point VPN portals. These gateways commonly expose client-related endpoints under paths such as:

/clients/
/vpn/
/sslvpn/

One endpoint of interest is:

https://<Gateway_IP>/clients/MyCRL

This endpoint is intended to serve client-side files, such as Certificate Revocation Lists (CRLs). Endpoints that read or return files are high-value targets for attackers.

Phase 2: Identifying File Access Behavior

Attackers send benign POST requests to the endpoint with simple values in the request body:

POST /clients/MyCRL
BODY: test

By analyzing server responses (errors, status codes, or content changes), attackers infer that: The server attempts to open a file path based on user-supplied input.

This confirms that the endpoint performs file access operations using request data.

Phase 3: Discovering Weak Validation Logic

Through trial and error, attackers test different path patterns and observe that requests containing the string:

CSHELL/

are consistently accepted.

Further experimentation reveals a critical behavior:

CSHELL/test        → accepted
aCSHELL/test       → accepted
123CSHELL/test     → accepted

This indicates that the backend does not validate the path structure, but merely checks whether a specific string exists anywhere in the input.

Root Cause

The backend uses loose string matching, likely via a function such as:

strstr(user_input, "CSHELL/")

This logic only checks for the presence of the string and does not ensure:

That the path starts with CSHELL/

That traversal sequences are blocked

That the resolved path stays within an allowed directory

Phase 4: Path Traversal Payload Construction

Once attackers confirm:

Their input becomes a file path

CSHELL/ satisfies validation

Traversal sequences are not sanitized

They combine these elements into a single payload:

aCSHELL/../../../../../../../etc/shadow

Payload Breakdown

a → Junk data (proves prefix does not matter)

CSHELL/ → Bypasses whitelist validation

../../../../../../../ → Escapes the intended directory

/etc/shadow → Sensitive system file

Phase 5: Exploitation via POST Request

The exploit is delivered using an unauthenticated POST request:

POST /clients/MyCRL
BODY: aCSHELL/../../../../../../../etc/shadow

Using the POST body is significant because:

Many WAFs focus on URL paths, not request bodies

Path traversal filters are often weaker or absent in POST data

Standard URL normalization protections are bypassed

Phase 6: File Resolution and Privilege Abuse

The vpnd process runs with root privileges.

When the application attempts to open the supplied path:

The operating system resolves the traversal sequences

The final resolved path becomes:

/etc/shadow

Since the process runs as root:

File access is permitted

The file is read successfully

The application then returns the raw file contents directly in the HTTP response.

Phase 7: Impact — Arbitrary File Read as Root

Attackers can retrieve any readable file on the system, including:

/etc/shadow → Password hashes for local and expert accounts

/config/db/initial → Configuration data and credentials

~/.ssh/id_rsa → Private SSH keys

VPN and authentication configuration files

This is not remote command execution, but its impact is often equivalent or worse.

Phase 8: Post-Exploitation Activity

Credential Abuse

Password hashes are cracked using tools like hashcat

Recovered credentials are reused for:

VPN access

SSH access

Administrative portals

Lateral Movement

Attackers authenticate legitimately into the internal network

MFA-less VPN accounts accelerate compromise

Domain Escalation

In observed incidents, attackers moved from the gateway to:

Domain Controllers

ntds.dit extraction

Full Active Directory compromise occurred within hours

Key Takeaway

This vulnerability demonstrates a critical lesson:

Security failures often stem from logic errors, not advanced exploitation techniques.

Trusting substring presence instead of validating resolved file paths allowed unauthenticated attackers to:

Bypass access controls

Abuse root privileges

Compromise entire enterprise environments

What we learned?

1. vpnd

In computer terminology, the "d" at the end stands for daemon — a program that runs silently in the background without needing a user interface. Depending on your system, it serves a specific role:

macOS / iOS: It is a built-in Apple process that manages VPN connections. It handles the "tunneling" protocol, assigns IP addresses to clients, and ensures the connection stays active.

Linux / Unix: Similar to macOS, it is often used as a shorthand name for various VPN-related background services (like openvpnd or strongswand) that keep the encrypted "tunnel" open while you browse

Check Point Firewalls: It is a core user-mode process responsible for negotiating security keys (IKE) and managing encrypted connections (SAs):

In the context of Check Point Firewalls, think of vpnd as the "Chief Negotiator" of a secret conversation.

When two computers want to talk privately, they can't just start sending secrets immediately — they first have to agree on a code. This is where vpnd steps in to handle two main jobs:

1. Negotiating Security Keys (IKE)

Before any data moves, the two systems need to trust each other. This happens via IKE (Internet Key Exchange).

The Handshake: vpnd reaches out to the other side and says, "I want to talk. Here are the encryption methods I support."

The Secret Password: They use complex math to agree on a shared "secret key" without actually sending the key over the internet where it could be stolen.

Identity Check: vpnd verifies that the other side is who they claim to be (using certificates or passwords).

2. Managing Connections (SAs)

Once the "handshake" is finished, they create a Security Association (SA).

The Contract: Think of an SA as a contract or a set of rules for the connection. It defines exactly which encryption algorithm will be used and how often the keys should change.

The Tunnel: vpnd manages these "contracts." If you have 50 different people connecting to the office via VPN, vpnd is keeping track of 50 different "contracts" (SAs) at the same time.

2. GAIA OS

Gaia is the unified 64-bit security operating system for all Check Point appliances, open servers, and virtualized gateways. It merges the best of Nokia's IPSO (performance/routing) and SecurePlatform (security/manageability).