Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Diyaa3791
Contributor
Jump to solution

IPS signature for CVE-2024-24919 not preventing

Hello everyone,

 

I am testing the IPS signature for CVE-2024-24919 and it doesn't seem to be preventing. I am intentionally not installing the hotfix for the CVE to test the IPS signature. It is also not working on gateways with the exploit (I mean it should be detecting the traffic coming in even if the exploit is patched. It would be good to know who is still attempting to exploit it).

 

2024-05-31_14-52.png

 

2024-05-31_14-53.png

 

2024-05-31_14-55.png

 

2024-05-31_15-07.png

 

2024-05-31_14-57.png

 

2024-05-31_14-59.png

 

2024-05-31_15-02.png

 

I don't see a log of the gateway IPS engine logging this attempt and you can clearly see in the screenshot above this one that it did go through.

2024-05-31_15-03.png

I think it would be good to have a log of what IPs are trying to exploit this on a gateway even after patching.

I thought it might be a good idea to bring this up with the Check Mate community after testing it in my home lab 🙂.

 

Thank you,

 

Diyaa

0 Kudos
2 Solutions

Accepted Solutions
Lesley
Leader Leader
Leader

This is due:

To prevent any attempt to exploit this vulnerability, you must protect the vulnerable Remote Access VPN gateway behind a Security Gateway with both IPS and HTTPS Inspection enabled. 

Listed in https://support.checkpoint.com/results/sk/sk182336

-------
If you like this post please give a thumbs up(kudo)! 🙂

View solution in original post

0 Kudos
_Val_
Admin
Admin

This IPS signature only protects gateways BEHIND one it is enforced on. 

View solution in original post

0 Kudos
15 Replies
Lesley
Leader Leader
Leader

This is due:

To prevent any attempt to exploit this vulnerability, you must protect the vulnerable Remote Access VPN gateway behind a Security Gateway with both IPS and HTTPS Inspection enabled. 

Listed in https://support.checkpoint.com/results/sk/sk182336

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
Diyaa3791
Contributor

So, I actually need another gateway in front of a gateway to actually log and detect this? 

0 Kudos
Lesley
Leader Leader
Leader

Correct, so it is better to install the patch. 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
Diyaa3791
Contributor

I am installing the patch. I just thought it would be nice to see the attempts in the logs.

 

0 Kudos
Lesley
Leader Leader
Leader

What I did is added all the known IP's and ranges to the gateway drop rule and make one group. (listed in SK)

And then use the group to search in old logs to see if something pops up there. It is not relevant to your questions just a tip.

Will take couple min to make the objects or script them 

-------
If you like this post please give a thumbs up(kudo)! 🙂
Diyaa3791
Contributor

I get what you are saying. Although port TCP/443 is a famous port, and it is always being scanned. The reason it would be nice to have an IPS detect log is to know who is actually still trying to exploit after the patch is on. Those IPs in the SKs would be good to look for in the log, but again. My goal to see all exploitation attempts from any IP with an IPS log.

I don't think this is doable for gateways directly attached to the internet, but that is what I was trying to look for.

With all that being said, I think you gave some nice tips and did amazing trying to assist with this 🙂. You deserve a gold star. Thank you.

0 Kudos
CaseyB
Advisor

You can see the logs by just searching "mycrl" and you'll see all the attempts. 

Lesley
Leader Leader
Leader

Able to share a screenshot of an example? I could use this information after the weekend. Many thanks 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
CaseyB
Advisor

Sure.

 

image.png

0 Kudos
Diyaa3791
Contributor

Is this a gateway behind another gateway?

0 Kudos
CaseyB
Advisor

Nope, it is the Internet facing gateway. 

0 Kudos
the_rock
Legend
Legend

I saw the same in my lab, with https inspection on.

Andy

0 Kudos
Lesley
Leader Leader
Leader

Thanks! With https inspection I assume? 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
CaseyB
Advisor

Correct. 

0 Kudos
_Val_
Admin
Admin

This IPS signature only protects gateways BEHIND one it is enforced on. 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events