CVE-2024-50623

CVE-2024-50623: Cleo Unrestricted File Upload Leading to Remote Code Execution

AI-generated analysis based on the vulnerability data on this page.

Summary

Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21 are affected by an unrestricted file upload and download vulnerability that can lead to remote code execution.

Background

Cleo Harmony, VLTrader, and LexiCom are enterprise software products from Cleo. The vulnerability exists in the file handling logic of affected versions.

Root Cause

The root cause is CWE-434: Unrestricted Upload of File with Dangerous Type. The application fails to adequately validate or restrict the types of files that can be uploaded or downloaded. This allows an attacker to introduce malicious files that the server may subsequently execute, leading to remote code execution.

Impact

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 9.8 (Critical).

• Confidentiality: HIGH - total loss of confidentiality.
• Integrity: HIGH - total loss of integrity.
• Availability: HIGH - total loss of availability.
• Attack Vector: NETWORK - exploitable remotely.
• Attack Complexity: LOW - no special conditions required.
• Privileges Required: NONE - no authentication needed.
• User Interaction: NONE - no user action required.

Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the affected service.

Exploitation Walkthrough

Ethics Caveat: This section is provided for defensive awareness only. Do not attempt to exploit systems without explicit authorization.

A generic attack flow would involve:

1. Discovery: An attacker identifies an exposed Cleo instance running an affected version prior to 5.8.0.21.
2. Upload: The attacker sends a crafted request to an upload endpoint, submitting a file with a dangerous type that the application accepts without sufficient validation.
3. Execution: If the upload path is accessible or the application otherwise processes the file, the attacker triggers execution via a subsequent request or automated processing.
4. Post-Exploitation: With code execution achieved, the attacker may establish persistence, exfiltrate data, or pivot within the network.

Defenders should assume that any endpoint accepting file uploads in these products is a potential attack surface.

Affected and Patched Versions

Organizations should upgrade to 5.8.0.21 or later.

Remediation

1. Upgrade: Apply the vendor-provided patch by upgrading to version 5.8.0.21 or later.
2. Network Segmentation: Restrict network access to Cleo interfaces to trusted hosts and segments.
3. File Upload Controls: If available, enable strict file-type validation and restrict upload directories from being directly executable.
4. File Integrity Monitoring: Monitor critical application directories for unauthorized file additions or modifications.
5. Least Privilege: Ensure the application service accounts run with the minimum necessary privileges.

Detection

• Monitor application logs for unexpected file upload or download requests directed at Cleo endpoints.
• Alert on the presence of suspicious files in upload directories.
• Review outbound network connections initiated by Cleo service accounts for signs of post-exploitation activity.
• Enable process monitoring to detect unexpected child processes spawned by the application runtime.

Assessment

With an EPSS score of 0.98529 (99.915th percentile), this vulnerability is among the most likely to be exploited in the wild. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog on 2024-12-13 and the EUVD (EUVD-2024-45217) exploited-since date of 2024-12-13 confirms active exploitation.

Key Lessons:

1. File transfer endpoints are high-value targets. Because they routinely process untrusted files and sit at network boundaries, they attract attackers seeking remote code execution.
2. Rapid weaponization demands rapid patching. The short interval between disclosure and KEV/EUVD listing indicates that threat actors moved quickly to weaponize this flaw. Patching velocity is the most critical control.

References

• https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623