IPS signature for CVE-2024-24919 not preventing

[Diyaa3791]

Hello everyone,

I am testing the IPS signature for CVE-2024-24919 and it doesn't seem to be preventing. I am intentionally not installing the hotfix for the CVE to test the IPS signature. It is also not working on gateways with the exploit (I mean it should be detecting the traffic coming in even if the exploit is patched. It would be good to know who is still attempting to exploit it).

I don't see a log of the gateway IPS engine logging this attempt and you can clearly see in the screenshot above this one that it did go through.

I think it would be good to have a log of what IPs are trying to exploit this on a gateway even after patching.

I thought it might be a good idea to bring this up with the Check Mate community after testing it in my home lab 🙂.

Thank you,

Diyaa

[Lesley · Accepted solution]

This is due:

To prevent any attempt to exploit this vulnerability, you must protect the vulnerable Remote Access VPN gateway behind a Security Gateway with both IPS and HTTPS Inspection enabled. 

Listed in https://support.checkpoint.com/results/sk/sk182336

[Diyaa3791]

So, I actually need another gateway in front of a gateway to actually log and detect this? 

[Lesley]

Correct, so it is better to install the patch. 

[Diyaa3791]

I am installing the patch. I just thought it would be nice to see the attempts in the logs.

[Lesley]

What I did is added all the known IP's and ranges to the gateway drop rule and make one group. (listed in SK)

And then use the group to search in old logs to see if something pops up there. It is not relevant to your questions just a tip.

Will take couple min to make the objects or script them 

[Diyaa3791]

I get what you are saying. Although port TCP/443 is a famous port, and it is always being scanned. The reason it would be nice to have an IPS detect log is to know who is actually still trying to exploit after the patch is on. Those IPs in the SKs would be good to look for in the log, but again. My goal to see all exploitation attempts from any IP with an IPS log.

I don't think this is doable for gateways directly attached to the internet, but that is what I was trying to look for.

With all that being said, I think you gave some nice tips and did amazing trying to assist with this 🙂. You deserve a gold star. Thank you.

[CaseyB]

You can see the logs by just searching "mycrl" and you'll see all the attempts. 

[Lesley]

Able to share a screenshot of an example? I could use this information after the weekend. Many thanks 

[CaseyB]

Sure.

[Diyaa3791]

Is this a gateway behind another gateway?

[CaseyB]

Nope, it is the Internet facing gateway. 

[the_rock]

I saw the same in my lab, with https inspection on.

Andy

[Lesley]

Thanks! With https inspection I assume? 

[CaseyB]

Correct. 

[_Val_ · Accepted solution]

This IPS signature only protects gateways BEHIND one it is enforced on.