Check Point Harmony SASE Exposed Log Files via Insecure SFTP Key Permissions

A vulnerability in the Harmony SASE agent allowed log files uploaded during troubleshooting to be accessed by unauthorized parties. These logs could have contained temporary authentication tokens. The issue arose because the agent used a shared SFTP key embedded in the software to upload diagnostic logs. This key was granted permissions to read and list files on the server, rather than being restricted to upload-only access. Consequently, anyone with the key could access log files uploaded by other customers.

Impact

Exposed log files could be accessed by unauthorized parties, potentially including temporary authentication tokens.

Remediation

The SFTP key's permissions have been downgraded to write-only. No action is required on the customer side.