topic Re: IPS signature for CVE-2024-24919 not preventing in General Topics

IPS signature for CVE-2024-24919 not preventing

Diyaa3791 — Fri, 31 May 2024 21:07:49 GMT

Hello everyone,

I am testing the IPS signature for CVE-2024-24919 and it doesn't seem to be preventing. I am intentionally not installing the hotfix for the CVE to test the IPS signature. It is also not working on gateways with the exploit (I mean it should be detecting the traffic coming in even if the exploit is patched. It would be good to know who is still attempting to exploit it).

I don't see a log of the gateway IPS engine logging this attempt and you can clearly see in the screenshot above this one that it did go through.

I think it would be good to have a log of what IPs are trying to exploit this on a gateway even after patching.

I thought it might be a good idea to bring this up with the Check Mate community after testing it in my home lab 🙂.

Thank you,

Diyaa

Re: IPS signature for CVE-2024-24919 not preventing

Lesley — Fri, 31 May 2024 21:13:26 GMT

This is due:

To prevent any attempt to exploit this vulnerability, you must protect the vulnerable Remote Access VPN gateway behind a Security Gateway with both IPS and HTTPS Inspection enabled.

Listed in https://support.checkpoint.com/results/sk/sk182336

Re: IPS signature for CVE-2024-24919 not preventing

Diyaa3791 — Fri, 31 May 2024 21:13:30 GMT

So, I actually need another gateway in front of a gateway to actually log and detect this?

Re: IPS signature for CVE-2024-24919 not preventing

Lesley — Fri, 31 May 2024 21:14:35 GMT

Correct, so it is better to install the patch.

Re: IPS signature for CVE-2024-24919 not preventing

Diyaa3791 — Fri, 31 May 2024 21:15:27 GMT

I am installing the patch. I just thought it would be nice to see the attempts in the logs.

Re: IPS signature for CVE-2024-24919 not preventing

Lesley — Fri, 31 May 2024 21:19:34 GMT

What I did is added all the known IP's and ranges to the gateway drop rule and make one group. (listed in SK)

And then use the group to search in old logs to see if something pops up there. It is not relevant to your questions just a tip.

Will take couple min to make the objects or script them

Re: IPS signature for CVE-2024-24919 not preventing

Diyaa3791 — Fri, 31 May 2024 21:37:26 GMT

I get what you are saying. Although port TCP/443 is a famous port, and it is always being scanned. The reason it would be nice to have an IPS detect log is to know who is actually still trying to exploit after the patch is on. Those IPs in the SKs would be good to look for in the log, but again. My goal to see all exploitation attempts from any IP with an IPS log.

I don't think this is doable for gateways directly attached to the internet, but that is what I was trying to look for.

With all that being said, I think you gave some nice tips and did amazing trying to assist with this 🙂. You deserve a gold star. Thank you.

Re: IPS signature for CVE-2024-24919 not preventing

CaseyB — Fri, 31 May 2024 21:40:13 GMT

You can see the logs by just searching "mycrl" and you'll see all the attempts.

Re: IPS signature for CVE-2024-24919 not preventing

Lesley — Fri, 31 May 2024 21:44:10 GMT

Able to share a screenshot of an example? I could use this information after the weekend. Many thanks

Re: IPS signature for CVE-2024-24919 not preventing

CaseyB — Fri, 31 May 2024 21:49:57 GMT

Sure.

Re: IPS signature for CVE-2024-24919 not preventing

Diyaa3791 — Fri, 31 May 2024 21:51:38 GMT

Is this a gateway behind another gateway?

Re: IPS signature for CVE-2024-24919 not preventing

Lesley — Fri, 31 May 2024 21:58:30 GMT

Thanks! With https inspection I assume?

Re: IPS signature for CVE-2024-24919 not preventing

CaseyB — Fri, 31 May 2024 23:23:55 GMT

Nope, it is the Internet facing gateway.

Re: IPS signature for CVE-2024-24919 not preventing

CaseyB — Fri, 31 May 2024 23:24:13 GMT

Correct.

Re: IPS signature for CVE-2024-24919 not preventing

the_rock — Fri, 31 May 2024 23:29:11 GMT

I saw the same in my lab, with https inspection on.

Andy

Re: IPS signature for CVE-2024-24919 not preventing

_Val_ — Sat, 01 Jun 2024 10:36:44 GMT

This IPS signature only protects gateways BEHIND one it is enforced on.