Full Report
Team Huntress has analyzed Cleo's software vulnerability CVE-2024-55956. Take a look at the technical breakdown of a new family of malware we’ve named Malichus.
Analysis Summary
# Vulnerability: Cleo Software Remote Code Execution (Malichus Implant)
## CVE Details
- **CVE ID**: CVE-2024-55956
- **CVSS Score**: Not explicitly listed in text (Assessed as **Critical** based on active exploitation and RCE nature)
- **CWE**: Improper Input Validation / Remote Code Execution
## Affected Systems
- **Products**: Cleo LexiCom, VLTransfer, and Harmony
- **Versions**: Versions prior to specific December 2024 patches (Exact version numbers were not detailed in the provided snippet, but refer to Cleo's official advisory).
- **Configurations**: Systems exposed to the public internet using default or vulnerable file transfer management configurations.
## Vulnerability Description
CVE-2024-55956 is a zero-day vulnerability in Cleo software that allows for unauthorized remote code execution. Attackers exploit this flaw to deploy a multi-stage malware infection. The attack chain begins with a PowerShell downloader that retrieves a Java-based payload. This payload serves as a downloader for "Malichus," a modular Java-based post-exploitation framework/backdoor that facilitates persistent access, data exfiltration, and further command execution.
## Exploitation
- **Status**: Exploited in the wild (Active 0-day as of late 2024).
- **Complexity**: Medium (Requires specific knowledge of Cleo software architecture).
- **Attack Vector**: Network (Remote).
- **PoC Availability**: Huntress has recreated the attack chain; however, public exploit code is limited to prevent further abuse.
## Impact
- **Confidentiality**: High (Ability to access file transfer data and system credentials).
- **Integrity**: High (Ability to modify system files and deploy additional malware).
- **Availability**: High (Ability to shut down services or corrupt the installation).
## Remediation
### Patches
- Users must update Cleo LexiCom, VLTransfer, or Harmony to the latest patched versions provided by the vendor. Refer to the Cleo support portal for specific build numbers released in response to this CVE.
### Workarounds
- Restrict access to Cleo management interfaces to trusted IP addresses only.
- Implement robust EDR/MDR monitoring on servers running Cleo software to detect anomalous PowerShell or Java execution.
## Detection
- **Indicators of Compromise (IoCs)**:
- Files named `cleo.[numerical-identifier]` (Java Archives).
- PowerShell scripts containing base64 blobs establishing TCP connections to unknown C2 IPs.
- Environment variables named `query` containing base64 encoded AES keys and C2 metadata.
- Network traffic appended with "TLS v3" strings (non-standard) used by the Malichus loader.
- **Detection Methods**:
- Monitor for `java.exe` or `javaw.exe` spawning PowerShell or making unusual outbound network connections.
- Scan for corrupted/repaired ZIP headers in temporary directories used by the Cleo service.
## References
- Cleo Security Advisory: [https://www.cleo.com/security-advisories] (General reference)
- Huntress Threat Advisory: [https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild]
- Technical Breakdown: [https://www.huntress.com/blog/cleo-software-vulnerability-malware-analysis]