CVE-2024-57728

What it actually does

SimpleHelp v5.5.7 and earlier contains a Zip Slip path traversal flaw in administrative ZIP upload handling. An authenticated administrator can upload a crafted archive whose entries contain traversal sequences such as ../ or ..\, causing the SimpleHelp server to write files outside the intended extraction directory. If the attacker writes to executable, web-served, service, plugin, startup, or configuration paths, they can execute arbitrary code with the privileges of the SimpleHelp server process. The impact is full compromise of confidentiality, integrity, and availability of the host running SimpleHelp, bounded by the SimpleHelp service account’s permissions.

Why it matters to the business

Because SimpleHelp is remote support software, compromise can give an attacker a powerful foothold into systems used for administration and support operations. This vulnerability is listed in CISA KEV, has active exploitation in the wild, and is associated with ransomware campaigns including Qilin, BianLian, RansomExx, DragonForce, and Play, making it a high-priority operational risk despite requiring administrative access. Successful exploitation can lead to service outage, data theft, lateral movement, customer support disruption, and ransomware deployment. CISA’s KEV remediation deadline is 2026-05-08.

How an attack unfolds

An attacker first obtains or abuses SimpleHelp administrative access, often through stolen credentials, exposed management interfaces, credential stuffing, phishing, or prior compromise. After logging in as an administrator, the attacker uploads a specially crafted ZIP archive containing file names with directory traversal sequences. When SimpleHelp extracts the archive, the vulnerable extraction logic writes files outside the intended upload location. The attacker places a file in a location that will be executed or loaded by the SimpleHelp server, operating system, service manager, scheduled task mechanism, web runtime, or application component. Once execution occurs, the attacker gains code execution as the SimpleHelp server user, then typically establishes persistence, harvests credentials, pivots through remote support capabilities, disables security tools, exfiltrates data, and may deploy ransomware.

How to fix it

Upgrade SimpleHelp to a vendor-supported version that fixes the Zip Slip vulnerability; all versions v5.5.7 and earlier should be treated as affected. If exact fixed versions are not centrally tracked, obtain the latest release directly from SimpleHelp and verify the vendor advisory or release notes before returning the service to normal exposure. Restrict administrative access to trusted networks or VPN, enforce MFA for all SimpleHelp administrators, rotate SimpleHelp administrator credentials, and remove unused admin accounts. Run the SimpleHelp service under a dedicated least-privilege account that cannot write to operating system, webroot, startup, or sensitive application directories. Monitor and restrict ZIP upload/import functionality where possible. If immediate upgrade is not possible, isolate the server from the internet, block untrusted administrative access, increase logging, and apply compensating controls at the reverse proxy or firewall layer.

How to confirm the fix worked

Confirm the deployed SimpleHelp version is newer than v5.5.7 and matches the vendor’s fixed release guidance. Review application configuration and package metadata on every SimpleHelp server, including standby or disaster recovery instances. In a non-production environment, validate that ZIP extraction rejects or safely normalizes archive entries containing ../ and ..\ and does not write outside the intended directory. Confirm the SimpleHelp service account has least-privilege filesystem permissions and cannot write to sensitive execution paths. Verify administrative access requires MFA and is restricted by network controls. After patching, review file integrity monitoring, EDR, and operating system logs to confirm no unexpected files were created by the SimpleHelp process before remediation.

Typical attack path

1. Identify an exposed SimpleHelp server and confirm it is running an affected version, v5.5.7 or earlier.
2. Gain SimpleHelp administrator access through stolen credentials, phishing, credential reuse, brute force against weak passwords, or prior compromise.
3. Upload a crafted ZIP archive containing path traversal entries that escape the intended extraction directory.
4. Cause the SimpleHelp server to write attacker-controlled files to a sensitive path on the host.
5. Trigger execution through an application reload, service restart, web-accessible script, plugin load, startup location, or scheduled execution path.
6. Run commands as the SimpleHelp server user and establish persistence.
7. Use the remote support server as a staging point for credential theft, lateral movement, data exfiltration, or ransomware deployment.

How to detect it

Investigate SimpleHelp application logs, administrative audit logs, web or reverse proxy access logs, authentication logs, operating system security logs, EDR telemetry, file integrity monitoring, and backup/change records. Look for unusual administrator logins, new admin accounts, logins from unfamiliar IP addresses or geographies, administrative ZIP upload/import activity, and archive entries or request parameters containing traversal patterns such as ../, ..\, or URL-encoded equivalents. On the host, look for files recently created or modified by the SimpleHelp service process outside expected upload or application directories, especially scripts, web-executable files, service definitions, scheduled tasks, startup items, SSH keys, binaries, or archives. Review process telemetry for the SimpleHelp service spawning shells or administrative utilities such as cmd.exe, powershell.exe, /bin/sh, bash, curl, wget, certutil, bitsadmin, rundll32, regsvr32, msiexec, or scripting interpreters. Because active exploitation has been associated with ransomware groups including Qilin, BianLian, RansomExx, DragonForce, and Play, extend hunting to credential dumping, discovery commands, remote execution, backup deletion, data compression, exfiltration tools, and ransomware staging. Absence of a known IOC does not rule out exploitation because attackers can choose arbitrary file names and paths.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• SimpleHelp
• cmd.exe /c
• powershell.exe
• pwsh.exe
• /bin/sh -c
• bash -c
• curl
• wget
• certutil.exe
• bitsadmin.exe
• rundll32.exe
• regsvr32.exe
• msiexec.exe
• schtasks.exe
• crontab
• vssadmin.exe Delete Shadows
• wmic shadowcopy delete
• bcdedit /set {default} recoveryenabled no

What your security team should do

• Treat this as an urgent remediation item because it is in CISA KEV, actively exploited, and associated with ransomware activity.
• Inventory all SimpleHelp deployments, including internet-facing, internal, backup, and legacy instances, and identify any running v5.5.7 or earlier.
• Upgrade to a vendor-supported fixed release or the latest available SimpleHelp version, then verify the installed version on host.
• Immediately restrict SimpleHelp administrative interfaces to trusted networks or VPN and require MFA for all administrators.
• Rotate SimpleHelp administrator passwords and review admin accounts for unauthorized, dormant, or recently created users.
• Hunt for signs of exploitation before and after patching, focusing on crafted ZIP uploads, unexpected filesystem writes, and child processes spawned by the SimpleHelp service.
• Review EDR telemetry for command execution, credential theft, lateral movement, remote access tooling, and ransomware staging activity from SimpleHelp servers.
• If compromise is suspected, isolate the host, preserve evidence, collect logs and suspicious files, rotate credentials that may have been exposed, and rebuild from trusted media if server integrity cannot be established.