Check Point warns of zero-day flaw exploited for root access - BleepingComputer
Check Point Software has released emergency hotfixes for a high-severity flaw that hackers have been exploiting to gain root privileges since late October.
The vulnerability exists in the DynamicCLI IPC interface used to send privileged command requests to the root-level Gaia OS DynamicCLI daemon. Check Point observed active exploits against 'a couple of dozen customers,' according to a Thursday security advisory.
The flaw allows authenticated local users to send commands to a world-writable socket that execute as root, potentially giving attackers complete control over vulnerable systems.
Affected Products
Multiple Check Point products are vulnerable, including Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. In some attacks, hackers first gained access via the PHP2Shell vulnerability before escalating privileges using this zero-day.
Attack Chain
After gaining root access, attackers deployed webshells, installed TSGA backdoor and TSProxy malware, then pivoted to VMware ESXi hosts to deploy destructive wiper malware. These tools were previously seen in attacks targeting Ivanti appliances.
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes.
Mitigation
Check Point advised customers who can't immediately deploy the hotfixes to stop the dynamic_server process and prevent it from restarting as a temporary measure. The company also shared indicators of compromise to help detect exploitation attempts.
Evidence of compromise may include uncommon use of the system() sink, commands not using the default Clish wrapper, or other suspicious activity. Check Point has added five of its flaws to CISA's catalog of actively exploited vulnerabilities in the past two years.
Related
