CVE-2024-50623

What it actually does

Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.21 allow unrestricted file upload and download. An attacker who can reach the Cleo service can upload files to locations the application processes, potentially causing attacker-controlled code or commands to execute with the privileges of the Cleo service account. The flaw can also permit unauthorized retrieval of files, which may expose configuration data, credentials, transfer definitions, logs, or business files handled by the managed file transfer platform.

Why it matters to the business

This is a critical internet-facing managed file transfer vulnerability with active exploitation, very high EPSS likelihood, CISA KEV listing, and known ransomware use. Successful exploitation can lead to compromise of file-transfer infrastructure, theft of sensitive partner or customer files, disruption of automated business transfers, lateral movement using stored credentials, and ransomware deployment. The CISA remediation deadline of 2025-01-03 has passed, so any remaining vulnerable instance should be treated as an urgent exposure and potential incident.

How an attack unfolds

An attacker identifies an exposed Cleo Harmony, VLTrader, or LexiCom service running a vulnerable version. They interact with the file transfer application endpoints to upload an arbitrary file without proper authorization or validation. If the uploaded content is placed in a directory or workflow that the Cleo application executes or interprets, the attacker obtains remote code execution under the Cleo service context. From there, the attacker may run reconnaissance commands, download configuration and transfer data, collect credentials or keys used for partner transfers, deploy web shells or persistence mechanisms, stage stolen files, and move to ransomware activity. Because this vulnerability is KEV-listed and associated with ransomware campaigns, exploitation should be assumed to be operationalized by threat actors rather than only theoretical.

How to fix it

Upgrade Cleo Harmony, VLTrader, and LexiCom to version 5.8.0.21 or later, and preferably to the latest vendor-supported release because related Cleo exploitation activity has included follow-on weaknesses and patch-bypass behavior. If immediate upgrade is not possible, restrict access to Cleo administrative and transfer interfaces to trusted networks or VPN, block direct internet exposure, disable nonessential protocols and automation features, and review vendor hardening guidance. Rotate credentials, API keys, SSH keys, certificates, and partner transfer secrets stored in or used by the Cleo platform if compromise is suspected. Remove unauthorized files from application, web, temporary, staging, and automation directories only after evidence preservation.

How to confirm the fix worked

Confirm the installed Cleo Harmony, VLTrader, or LexiCom version is 5.8.0.21 or later, or the latest vendor-supported build. Validate that exposed services are no longer reachable from untrusted networks except where explicitly required and protected. Review application configuration to ensure upload locations, automation directories, and executable paths are not writable by unauthenticated or low-privileged users. Perform an authenticated configuration review and vulnerability scan where safe. Check vendor logs and file system timestamps for suspicious uploads before the upgrade date, because patching confirms remediation but does not rule out prior compromise.

Typical attack path

1. Scan the internet or known partner-facing infrastructure for exposed Cleo Harmony, VLTrader, or LexiCom services.
2. Fingerprint the product and version or test behavior consistent with versions before 5.8.0.21.
3. Use the unrestricted upload/download weakness to write attacker-controlled content to the server.
4. Trigger application processing of the uploaded file to execute commands or code under the Cleo service account.
5. Download configuration files, logs, transfer definitions, credentials, keys, or business files accessible to the Cleo application.
6. Establish persistence or deploy additional tooling.
7. Use harvested credentials and network access for lateral movement, data theft, extortion, or ransomware deployment.

How to detect it

Review Cleo Harmony, VLTrader, and LexiCom application logs for unexpected upload or download requests, failed or unusual authentication patterns, new files created shortly before command execution, and transfer activity from unfamiliar IP addresses. Correlate reverse proxy, WAF, load balancer, VPN, and firewall logs for requests to Cleo services from unknown sources, especially followed by outbound connections from the Cleo server. On endpoints, inspect the Cleo installation, temporary, staging, web, logs, and automation/autorun directories for recently created files with script, archive, XML, Java, JSP, BAT, CMD, PowerShell, or shell extensions. Review EDR telemetry for Cleo service processes spawning command interpreters or scripting engines such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, sh, bash, curl, wget, certutil, bitsadmin, java, or msiexec. Look for access to configuration files, host definitions, keystores, certificates, SSH keys, and password stores followed by network egress. Because ransomware use is reported, also hunt for staging archives, mass file access, credential dumping, privilege escalation, lateral movement, and ransomware precursor tooling on or originating from Cleo servers.

• Cleo Harmony version < 5.8.0.21
• Cleo VLTrader version < 5.8.0.21
• Cleo LexiCom version < 5.8.0.21
• autorun
• cmd.exe spawned by Cleo
• powershell.exe spawned by Cleo
• wscript.exe spawned by Cleo
• cscript.exe spawned by Cleo
• sh spawned by Cleo
• bash spawned by Cleo
• curl spawned by Cleo
• wget spawned by Cleo
• certutil.exe spawned by Cleo
• bitsadmin.exe spawned by Cleo
• msiexec.exe spawned by Cleo
• java.exe spawned by Cleo
• .jsp file created in Cleo directory
• .jar file created in Cleo directory
• .bat file created in Cleo directory
• .cmd file created in Cleo directory
• .ps1 file created in Cleo directory
• .sh file created in Cleo directory
• unexpected file upload to Cleo
• unexpected file download from Cleo

What your security team should do

• Immediately inventory all Cleo Harmony, VLTrader, and LexiCom deployments, including partner-facing, test, disaster-recovery, and legacy systems.
• Prioritize emergency upgrade to 5.8.0.21 or later, preferably the latest vendor-supported release, especially for internet-facing systems.
• Because this vulnerability is KEV-listed, ransomware-associated, and past the CISA due date, treat any unpatched exposure as a potential compromise and initiate threat hunting.
• Temporarily restrict Cleo access to trusted source IPs or VPN until patching and validation are complete.
• Collect and preserve Cleo application logs, web/proxy logs, endpoint telemetry, file listings, and recent filesystem metadata before cleanup.
• Hunt for suspicious file uploads, unexpected files in automation or application directories, abnormal child processes spawned by the Cleo service, and outbound connections from Cleo servers.
• Rotate credentials, SSH keys, API tokens, certificates, and partner secrets used by Cleo if exploitation cannot be confidently ruled out.
• Review data transfer logs to identify unauthorized downloads or unusual partner-transfer activity.
• Coordinate with business owners and external transfer partners if evidence suggests file theft or credential compromise.