CVE-2024-50623
Cleo Multiple Products Unrestricted File Upload Vulnerability
Description
CVE-2024-50623 is a critical unrestricted file upload and download vulnerability affecting Cleo Harmony, VLTrader, and LexiCom products prior to version 5.8.0.21. The flaw allows remote, unauthenticated attackers to upload and download arbitrary files on the server, ultimately leading to remote code execution. With a CVSS v3.1 base score of 9.8 and a network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses an extreme risk to organizations relying on Cleo's managed file transfer solutions. CISA has added CVE-2024-50623 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2025, and its EPSS score of 94.01% at the 99.9th percentile places it among the most actively exploited vulnerabilities globally. This vulnerability is associated with known ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cleo | harmony | < 5.8.0.21 |
| cleo | lexicom | < 5.8.0.21 |
| cleo | vltrader | < 5.8.0.21 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2024-50623 involves CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical class of vulnerability where an application allows users to upload files without properly restricting the file type, content, or destination. In the context of Cleo's managed file transfer products, the web-accessible interface fails to enforce adequate restrictions on which files can be uploaded to the server, enabling attackers to place executable content — such as web shells or malicious scripts — in locations where it can be triggered for code execution. Combined with an unrestricted file download capability, attackers can also exfiltrate sensitive data stored on the server. This weakness is particularly dangerous in file transfer platforms because their core function involves accepting and serving files, making the attack surface inherently large.
CWE-22: Path Traversal
The vulnerability also relates to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The unrestricted file operations in CVE-2024-50623 allow attackers to craft URLs that navigate outside intended directories, enabling both upload and download of files to and from arbitrary locations on the server filesystem. This path traversal component amplifies the impact beyond simple file upload, providing attackers with comprehensive filesystem access.
Impact Analysis
The impact of CVE-2024-50623 is catastrophic across all dimensions of the CIA triad. Confidentiality is fully compromised as the unrestricted file download capability allows attackers to exfiltrate any file accessible to the application process, including transferred documents, configuration files, credentials, encryption keys, and sensitive business data passing through the managed file transfer platform. Given that Cleo products are specifically designed to handle high-value business file transfers — including EDI transactions, healthcare records, and financial data — the volume and sensitivity of exposed data can be enormous.
Integrity faces maximum impact because the unrestricted file upload allows attackers to place malicious content anywhere on the filesystem, modify existing files, inject backdoors, alter transferred documents, and deploy web shells for persistent access. Attackers can tamper with files in transit, potentially affecting downstream business partners and supply chain operations.
Availability is fully threatened as remote code execution enables attackers to disable the file transfer service, deploy ransomware, corrupt data, or completely destroy the system. The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), making mass exploitation straightforward. The EPSS score of 94.01% at the 99.9th percentile confirms that this vulnerability is among the most actively targeted in the entire vulnerability landscape, and CISA has confirmed its use in known ransomware campaigns, making immediate remediation essential.
Exploit Maturity
CVE-2024-50623 has reached maximum exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog and has explicitly linked it to known ransomware campaigns, indicating that ransomware operators are actively leveraging this vulnerability to encrypt victim networks and extort organizations. The EPSS score of 94.01% at the 99.9th percentile places this among the top 0.1% of all vulnerabilities by exploitation probability.
The Cleo Product Security Advisory provides the vendor's official disclosure and remediation guidance. Exploitation campaigns targeting Cleo products have been widely documented, with threat actors scanning the internet for vulnerable instances and deploying automated exploitation tools. The file transfer platform market segment has been a primary target for sophisticated threat actors and ransomware gangs throughout 2023 and 2024, with similar campaigns affecting MOVEit, GoAnywhere, and other managed file transfer solutions. CVE-2024-50623 continues this pattern, with attackers exploiting the unrestricted file operations to gain initial access, deploy web shells, exfiltrate data, and ultimately deliver ransomware payloads.
Remediation
-
Immediately upgrade all Cleo products to version 5.8.0.21 or later. This applies to Cleo Harmony, VLTrader, and LexiCom installations. The Cleo Product Security Advisory provides specific upgrade instructions and patch details for each product.
-
Isolate vulnerable instances from the network immediately if patching cannot be performed right away. Place Cleo servers behind a VPN or restrict access to known, trusted IP addresses. Disable any public-facing web interfaces until the patch is applied.
-
Conduct a thorough forensic investigation on all Cleo instances that were running vulnerable versions while exposed to untrusted networks. Search for unauthorized files, web shells, new user accounts, modified configurations, and evidence of data exfiltration. Pay particular attention to unusual files in web-accessible directories and any scheduled tasks or cron jobs that may indicate persistent access.
-
Review and rotate all credentials associated with or processed through the Cleo platform. This includes service accounts, API keys, partner credentials, encryption keys, and any authentication tokens that may have been accessible on the compromised server.
-
Implement network monitoring to detect indicators of compromise associated with ransomware activity. Monitor for unusual outbound connections, lateral movement attempts, and data exfiltration patterns originating from Cleo servers. Deploy endpoint detection and response tools on all systems hosting Cleo products.
Technical Details
CVE-2024-50623 is an unrestricted file upload and download vulnerability in Cleo Harmony, VLTrader, and LexiCom managed file transfer products. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a network-accessible attack with no prerequisites and maximum impact across all CIA dimensions.
The vulnerability resides in the file handling mechanisms of Cleo's web management interface and file transfer endpoints. The application fails to properly validate and restrict file upload and download operations, allowing unauthenticated attackers to craft HTTP requests that upload arbitrary files to the server or download files from arbitrary locations. The lack of file type validation means attackers can upload executable content such as JSP web shells, script files, or compiled binaries. The path traversal component allows these operations to target directories outside the intended upload location.
The attack chain typically begins with an attacker uploading a web shell or malicious script to a web-accessible directory on the Cleo server. Once the file is in place, the attacker requests the uploaded file through the web interface, triggering its execution. This grants the attacker interactive command execution on the server with the privileges of the Cleo application process. From this initial foothold, attackers can enumerate the network, exfiltrate transferred files and credentials, establish persistent access, and deploy additional malware including ransomware.
The scope is unchanged (S:U), meaning the vulnerability is contained within the Cleo application's security context, but since the application typically runs with elevated privileges to manage file operations and integrations, the practical impact extends to the entire server and potentially connected systems.
Frequently Asked Questions
What is CVE-2024-50623?
CVE-2024-50623 is a critical unrestricted file upload and download vulnerability in Cleo Harmony, VLTrader, and LexiCom managed file transfer products prior to version 5.8.0.21. It allows unauthenticated remote attackers to upload and download arbitrary files, leading to remote code execution.
Is CVE-2024-50623 being used in ransomware attacks?
Yes. CISA has confirmed that CVE-2024-50623 is associated with known ransomware campaigns. Threat actors are actively exploiting this vulnerability to gain initial access to organizations' networks and deploy ransomware.
Which Cleo products are affected by CVE-2024-50623?
Three Cleo products are affected: Cleo Harmony, Cleo VLTrader, and Cleo LexiCom, all in versions prior to 5.8.0.21. All three products share the same vulnerable file handling code.
How can I tell if my Cleo server has been compromised?
Look for unauthorized files in web-accessible directories, especially files with executable extensions such as .jsp or .sh. Check server logs for unusual file upload and download requests from unknown IP addresses. Monitor for unexpected outbound network connections and review system processes for unfamiliar entries.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.