CVE-2024-52885
📋 TL;DR
This directory traversal vulnerability in Check Point's Mobile Access Portal File Share application allows authenticated malicious users to list file names in directories accessible to the 'nobody' user account. It affects organizations using Check Point Mobile Access Portal with File Share functionality. Attackers must have valid credentials and access to at least one File Share application.
💻 Affected Systems
- Check Point Mobile Access Portal
📦 What is this software?
Mobile Access by Checkpoint
Remote Access Vpn by Checkpoint
⚠️ Risk & Real-World Impact
Worst Case
An attacker could map the file system structure, discover sensitive files, and potentially combine with other vulnerabilities for further exploitation.
Likely Case
Information disclosure of directory contents and file names that could aid in reconnaissance for targeted attacks.
If Mitigated
Limited exposure with proper access controls and monitoring in place.
🎯 Exploit Status
Requires authenticated access and knowledge of directory traversal techniques. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R81.20.40, R81.10.90, or R80.40.150
Vendor Advisory: https://support.checkpoint.com/results/sk/sk183137
Restart Required: No
Instructions:
1. Log into Check Point Security Management Server. 2. Navigate to Software Updates. 3. Apply the relevant hotfix: R81.20.40, R81.10.90, or R80.40.150. 4. Verify the update completes successfully.
🔧 Temporary Workarounds
Disable File Share Application
Check Point Gaia OSTemporarily disable the File Share functionality in Mobile Access Portal until patching is complete.
cpca_client disable fileshare
Restrict User Access
allReview and tighten user permissions for Mobile Access Portal, limiting File Share access to essential users only.
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual file listing activities
- Segment network to isolate Mobile Access Portal from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check current version with: 'fw ver' and compare against vulnerable versions (pre-R81.20.40, R81.10.90, R80.40.150)Check Version:
fw verVerify Fix Applied:
Verify version is R81.20.40, R81.10.90, or R80.40.150 or later using: 'fw ver'📡 Detection & Monitoring
Log Indicators:
- Unusual file listing requests in Mobile Access Portal logs
- Multiple directory traversal patterns in access logs
Network Indicators:
- Abnormal patterns of file enumeration requests to Mobile Access Portal
SIEM Query:
source="mobile_access_logs" AND ("../" OR "..\" OR "%2e%2e%2f") AND action="list"