Cleo Harmony/VLTrader/LexiCom Unrestricted File Upload RCE
- Product
- Cleo Harmony / VLTrader / LexiCom
- CVE
- CVE-2024-50623CVE-2024-55956
- Disclosed
- 2024-10-27
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Cleo Harmony, VLTrader and LexiCom before 5.8.0.21 (CVE-2024-50623) and before 5.8.0.24 (CVE-2024-55956).
- Fixed
- 5.8.0.24.
Summary
Huntress observed mass exploitation of Cleo MFT products in December 2024, with attackers bypassing the October patch for CVE-2024-50623. Cl0p later claimed the campaign and leaked data from dozens of victims.
Root cause
Unauthenticated file upload/download functionality allowed writing arbitrary files to the server. Attackers wrote files into the autorun directory, which Cleo processes automatically, causing attacker-supplied commands to execute.
Impact
Unauthenticated code execution and data theft from file transfer servers.
Detection
Look for unexpected files in the autorun directory, suspicious main.xml or *.jar files, and PowerShell spawned by Cleo processes; Huntress published IOCs.
Mitigation
Upgrade to 5.8.0.24, disable Autorun, and put Cleo behind a firewall.