CVE-2024-50623: Widespread Exploitation of Cleo File Transfer Software
A critical vulnerability, CVE-2024-50623, has been identified in Cleo file transfer software products, including Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21. This vulnerability exposes systems to significant risks, including remote code execution (RCE), due to unrestricted file upload and download functionality.
What is CVE-2024-50623?
The vulnerability allows attackers to upload and download files without proper restrictions, potentially enabling remote code execution on vulnerable systems. This flaw has been classified as high severity, with a CVSS score of 8.8, indicating a critical risk. The impacted versions of Cleo Harmony, VLTrader, and LexiCom have been exploited in the wild, making it essential for users to take immediate action.
How Does It Work?
The unrestricted file upload and download mechanism within these applications creates an opportunity for malicious actors to inject harmful files or code into the affected systems. Once uploaded, these files can be executed remotely, compromising the system and potentially leading to further exploitation.
What Can Be Done to Protect Your Systems?
To mitigate the risks associated with this vulnerability, the primary action is to update Cleo software to the latest version. Cleo has already released version 5.8.0.21, which addresses this flaw. Users should immediately upgrade to this version or later to close the vulnerability.
Additionally, organizations should:
- Limit File Uploads: Implement controls to restrict which files can be uploaded to the server, reducing the chances of a malicious file being executed.
- Monitor for Exploitation: Regularly check logs and monitor systems for unusual activities that may indicate exploitation.
- Apply Web Application Firewalls (WAFs): Consider using a WAF to filter out potential malicious file uploads.
Conclusion
The CVE-2024-50623 vulnerability presents a serious threat to Cleo file transfer software users. Immediate action, including updating to the latest software versions and implementing additional security measures, is crucial in defending against potential exploits.
For further details, check Cleo's product security advisory.