Full Report
Huntress identified an emerging threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, known as CVE-2024-55956, commonly used to manage file transfers. Read more about this emerging threat on the Huntress Blog.
Analysis Summary
# Vulnerability: Critical RCE in Cleo File Transfer Software
## CVE Details
- **CVE ID:** CVE-2024-55956 (Related to CVE-2024-50623)
- **CVSS Score:** Not explicitly listed in text, but categorized as unauthenticated Remote Code Execution (RCE)
- **CWE:** Arbitrary File Write / Path Traversal (leading to RCE)
## Affected Systems
- **Products:** Cleo Harmony®, Cleo VLTrader®, and Cleo LexiCom®
- **Versions:** All versions prior to and including **5.8.0.21**
- **Configurations:** Systems exposed to the internet are at highest risk. Default installation paths are commonly targeted:
- `C:\LexiCom\`
- `C:\VLTrader\`
- `C:\Harmony\`
- `C:\Program Files (x86)\...`
## Vulnerability Description
The flaw is an arbitrary file-write vulnerability that allows an unauthenticated attacker to drop files onto the server's filesystem. Attackers utilize this to place malicious files into the `autorun\` subdirectory. The Cleo software automatically reads, interprets, and executes files placed in this folder. By chaining the file write with the "Import" functionality, attackers can stage ZIP files containing malicious XML configurations (`main.xml`) to execute PowerShell commands and gain full system access.
## Exploitation
- **Status:** **Exploited in the wild** (mass exploitation observed).
- **Complexity:** Low (Unauthenticated RCE).
- **Attack Vector:** Network.
- **PoC Availability:** Recreated by researchers (Huntress); indicates the initial vendor patch for CVE-2024-50623 was insufficient.
## Impact
- **Confidentiality:** Total (Full system access and file exfiltration).
- **Integrity:** Total (Ability to modify files and system configurations).
- **Availability:** Total (Ability to execute arbitrary code and commands).
## Remediation
### Patches
- **Status:** **CRITICAL.** As of the latest update, systems running version **5.8.0.21** remain exploitable. Users should monitor for a new patch from Cleo that effectively mitigates the flaw.
### Workarounds
- **Firewall Isolation:** Immediately move all internet-exposed Cleo LexiCom, VLTrader, and Harmony systems behind a VPN or restrictive firewall.
- **Restrict Access:** Limit access to the administrative web interface to trusted internal IPs only.
## Detection
### Indicators of Compromise (IoC)
- **File Artifacts:**
- `autorun\healthchecktemplate.txt`
- `autorun\healthcheck.txt`
- `temp\LexiCom[RandomNumbers].tmp` (often a ZIP file in disguise)
- **Log Signatures:** Look in `logs\LexiCom.xml` (or equivalent) for:
- Unusual "Import" actions.
- Timestamps set to `2020/10/10 00:00:00` in XML configurations.
- **Process Activity:** Unusual PowerShell execution child processes originating from the Cleo service.
### Detection Methods
- Audit the `autorun` folder for unexpected files (though attackers often delete them immediately after execution).
- Review software logs for the string "Import" associated with `.tmp` files in the `temp` directory.
## References
- Cleo Product Security Advisory: hxxps[://]support[.]cleo[.]com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
- Huntress Blog: hxxps[://]www[.]huntress[.]com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild