Cleo patches zero-day exploited by ransomware gang
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50623 | Unauthenticated RCE via Unrestricted File Upload in Cleo Harmony, VLTrader, LexiCom CVE-2024-50623 is an unrestricted file upload and download flaw (CWE-434) in Cleo's managed file transfer products — Harmony, VLTrader, and LexiCom — before version 5.8.0.21. It is reachable over the network with no authentication or user interaction (CVSS 9.8, AV:N/AC:L/PR:N), letting an attacker send crafted requests that upload arbitrary files to the server. The unrestricted upload leads to remote code execution, giving the attacker full control of the host for staging, data theft, or ransomware, while the download capability risks exposure of business files the server moves with trading partners. Any organization running these products is affected, and managed file transfer servers are typically internet-facing and handle sensitive B2B data. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2024-12-13 with ransomware use noted, EPSS assigns a 98.6% probability of exploitation within 30 days, and the Clop ransomware gang has claimed dozens of breaches (some disputed), including a confirmed breach at WK Kellogg. Do: Upgrade Harmony, VLTrader, and LexiCom to 5.8.0.21 or later per vendor instructions; if upgrading is not possible, apply vendor mitigations or discontinue use of the product, as CISA's KEV entry requires. Prioritize internet-exposed instances, hunt for indicators of compromise (unexpected file writes and execution on the transfer host, new accounts, suspicious outbound connections), and restrict the service to trusted partner networks. Given known ransomware use by Clop, any suspected compromise should trigger checks for lateral movement and staged exfiltration of transferred files. | 9.8 | 99% | KEV ransomware |
| moderate≈1,000–3,000 internet-exposed Cleo servers (tens of thousands of enterprise deployments) | |
| CVE-2024-55956 | Unauthenticated File Upload RCE in Cleo Harmony, VLTrader, and LexiCom CVE-2024-55956 is an unauthenticated command-execution flaw (CWE-77) in Cleo's managed file transfer products: by default the Autorun directory automatically imports and runs files, so an unauthenticated attacker can import Bash or PowerShell commands that execute on the host. It is triggered over the network with no authentication and no user interaction (CVSS 3.1 score 9.8), by sending crafted import requests to a vulnerable Cleo server. Successful exploitation yields arbitrary command execution on the server, enabling data theft, lateral movement, and ransomware deployment. Any organization running Cleo Harmony, VLTrader, or LexiCom before 5.8.0.24 is affected — typically enterprises using these servers for EDI and partner file exchange. The flaw is actively exploited in the wild: it was added to CISA KEV on 2024-12-17 with known ransomware use (widely attributed to Cl0p), EPSS is 94% (top percentile), and confirmed downstream breaches such as WK Kellogg's have been tied to it. Do: Upgrade all Cleo Harmony, VLTrader, and LexiCom instances to 5.8.0.24 or later immediately, per the CISA KEV required action to apply vendor mitigations or discontinue use. If patching is delayed, restrict or remove internet exposure of the server. Because exploitation is confirmed and ransomware-linked, inspect the Autorun directory for unexpected imported files, review application logs for executed commands, and hunt for signs of data exfiltration or staging. | 9.8 | 94% | KEV ransomware PoC |
| largetens of thousands of installations (Cleo cites 100,000+ business customers; public internet scans showed roughly 1,000–2,000 exposed instances) |
Full article777 words · extracted from helpnetsecurity.com · click to collapse
Cleo has released a security patch to address the critical vulnerability that started getting exploited while still a zero-day to breach internet-facing Cleo Harmony, VLTrader, and LexiCom instances.
Version 5.8.0.24 of the three products, which was pushed out on Wednesday, plugs the hole that allowed attackers into vulnerable installations, where they moved to establish a reverse shell connection to their servers and perform reconnaissance.
Huntress researcher John Hammond confirmed that the patch is effective at blocking the proof-of-concept exploit they (re)created based on the attacks they’ve observed.
Clearing up the confusion
Huntress researchers initially believed that the attackers were leveraging CVE-2024-50623, and that the attack was made possible by Cleo fumbling a patch for the flaw that was incorporated in v5.8.0.21 of Harmony, VLTrader, and LexiCom in October 2024.
As Hammond told Help Net Security on Tuesday, even after conferring with Cleo about their PoC exploit, they are still unclear on whether the attackers are exploiting CVE-2024-50623 (an unrestricted file upload and download vulnerability) or the other CVE-pending vulnerability Cleo finally fixed on Wednesday.
“Based on Cleo actively working to craft a new patch and designate a new CVE, it’s fair to assume the December exploitation is a separate issue from the October CVE, but truthfully Cleo is the only source that will know for sure,” he told us.
Attack flow and malware
In the meantime, various security companies have been warning about the attacks they’ve detected and have shared insight into the malicious payloads the attackers have been dropping.
Sophos X-Ops says that they’ve seen 50+ unique hosts targeted by attackers, mostly belonging to retail organizations that operate within North America.
Huntress researchers have published an analysis of the multi-stage malware implant that the attackers are using, which they’ve dubbed Malichus. It creates a connection from compromised servers to the attacker’s command and control (C2) server to download next-stage payloads.
“The final stage is a modular Java-based post-exploitation framework which contains a significant amount of functionality. The framework supports both Linux and Windows however Huntress only observed usage on Windows,” they shared.
The post-exploitation framework:
- Deletes the first stage payload (downloader)
- Sends out status updates to the C2 server
- Allows operators to read and collect files or directories
- Allows operators to retrieve Cleo configuration files (for information about the installation) and issue execution commands
- Allows operators to perform basic read and write operations on the filesystem
Rapid7 researchers have visually explained the attack flow thusly:
Attack flow (Source: Rapid7)
After initial exploitation, they’ve also observed the attacker:
- Executing commands aimed at gathering user, group and system information from the impacted system and displaying domain trust relationships
- Executing an overpass-the-hash attack to create a valid Kerberos ticket and thus gain access to additional network resources within the impacted environment.
What should organizations that use these Cleo solutions do?
“Cleo strongly recommends customers apply the available patch immediately,” a company spokesperson told Help Net Security.
Disabling the Autorun feature can also hobble the attacker’s exploit. Restricting access to Cleo systems – e.g., by putting them behind a firewall or by setting up a limited IP allowlist – is also a good idea, especially if updating is impossible at the moment.
But it’s also crucial to investigate whether your instances have been accessed and compromised by the attackers. Cleo has provided indicators of compromise, advice and scripts for locating malicious files and locating and quarantining affected hosts (in a document behind a registration wall), and Huntress and Rapid7 have shared some, as well.
If there’s evidence of compromise, you should widen your investigation to discover whether the attacker has jumped on other systems on your network.
According to cybersecurity expert Kevin Beaumont, “Termite ransomware group operators (and maybe other groups) have a zero day exploit for Cleo LexiCom, VLTransfer, and Harmony.”
We still don’t know which group or groups are behind these attacks, but Termite is a strong contender: the group has claimed the attack on Blue Yonder, and they reportedly had an internet-facing Cleo instance.
UPDATE (December 13, 2024, 05:35 a.m. ET):
An identifier has been assigned to the Cleo vulnerability exploited as a zero-day: CVE-2024-55956.
CVE-2024-50623 has been added to CISA’s Known Exploited Vulnerabilities catalog, and marked as used in ransomware campaigns.
UPDATE (December 16, 2024, 01:25 p.m. ET):
Rapid7 researchers have analyzed the recently numbered CVE-2024-55956 vulnerability, which they say is not a patch bypass of CVE-2024-50623, and have explained how it’s being exploited.
It is an unauthenticated file write vulnerability and the patch for it is working, they added.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/12/12/cleo-patches-zero-day-exploited-by-ransomware-gang/