CVE-2024-55956
Cleo Multiple Products Unauthenticated File Upload Vulnerability
Description
CVE-2024-55956 is a critical unauthenticated remote code execution vulnerability affecting Cleo Harmony, VLTrader, and LexiCom file transfer products before version 5.8.0.24. The flaw allows an unauthenticated attacker to import and execute arbitrary Bash or PowerShell commands on the host system by exploiting the default configuration of the Autorun directory. With a CVSS v3.1 base score of 9.8 and an EPSS score of 89.14% at the 99.5th percentile, this vulnerability is among the most actively exploited file transfer flaws. CISA has added CVE-2024-55956 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 7, 2025, and this vulnerability has a confirmed association with ransomware operations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cleo | harmony | < 5.8.0.24 |
| cleo | lexicom | < 5.8.0.24 |
| cleo | vltrader | < 5.8.0.24 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending(Vendor Advisory)
- https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update(Vendor Advisory)
- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956(US Government Resource)
Weakness Type
Unauthenticated Command Execution via Autorun Directory
CVE-2024-55956 exploits a dangerous default configuration in Cleo's file transfer products where the Autorun directory automatically processes and executes imported files without authentication. The vulnerability allows an unauthenticated user to place arbitrary Bash or PowerShell scripts into this Autorun directory, which the application then executes on the host operating system. This represents a critical design flaw where the convenience of automated file processing overrides fundamental security principles. The Autorun mechanism was intended to facilitate automated workflows in file transfer operations, but its default configuration lacks authentication requirements, turning it into a direct unauthenticated command execution vector accessible from the network.
Impact Analysis
The impact of CVE-2024-55956 is maximum across all CIA dimensions, compounded by its confirmed use in ransomware campaigns. Confidentiality is catastrophically compromised because arbitrary command execution on file transfer servers grants access to all files being transferred, stored credentials, configuration data, and any other information accessible to the application process. Cleo products are enterprise managed file transfer (MFT) solutions that handle sensitive business data, financial records, healthcare information, and supply chain communications. A single compromise can expose massive volumes of sensitive data from multiple business partners.
Integrity faces maximum impact as the attacker can modify files in transit, alter transfer configurations, inject malicious content into automated workflows, and manipulate business-critical data flows. The ability to execute arbitrary commands also enables installation of persistent backdoors, modification of system files, and deployment of additional malicious tools.
Availability is fully compromised because command execution enables the attacker to encrypt files (as demonstrated in ransomware attacks), disable the file transfer service, destroy data, or render the system inoperable. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). The EPSS score of 89.14% at the 99.5th percentile confirms near-certain exploitation. Critically, CISA has confirmed a known ransomware association, meaning this vulnerability is being actively used in extortion campaigns, with the Cl0p ransomware group specifically linked to mass exploitation of Cleo file transfer products.
Exploit Maturity
CVE-2024-55956 demonstrates maximum exploit maturity with confirmed mass exploitation in ransomware campaigns. The vulnerability was actively exploited as a zero-day before patches were available, and Huntress published a detailed threat advisory documenting active exploitation campaigns targeting Cleo products in the wild.
CISA confirmed active exploitation and notably classified this vulnerability with a known ransomware association, one of the most serious designations in the KEV catalog. The Cl0p ransomware group, previously responsible for mass exploitation of the MOVEit Transfer vulnerability, has been linked to these attacks, following their established pattern of targeting managed file transfer platforms for large-scale data theft and extortion. The EPSS score of 89.14% at the 99.5th percentile reflects the extensive exploitation activity. Cleo's security advisory provides remediation guidance. The pattern of MFT platform exploitation by ransomware groups, from Accellion FTA through GoAnywhere MFT and MOVEit Transfer to now Cleo products, demonstrates that file transfer platforms remain the highest-priority targets for data extortion operations.
Remediation
-
Upgrade all Cleo products to version 5.8.0.24 or later immediately. Apply the patch to Cleo Harmony, VLTrader, and LexiCom installations as an emergency change. The Cleo security update provides specific upgrade procedures. Given the confirmed ransomware exploitation, this is the highest possible remediation priority.
-
Disable or secure the Autorun directory immediately as a temporary mitigation. If immediate patching is not possible, disable the Autorun functionality or remove all files from the Autorun directory and restrict write permissions. This eliminates the attack vector while patches are being prepared for deployment.
-
Conduct comprehensive forensic investigation. Any Cleo instance running versions before 5.8.0.24 that was accessible from untrusted networks should be treated as potentially compromised. Search for indicators of compromise including unauthorized files in the Autorun directory, evidence of Bash or PowerShell command execution, unexpected outbound connections, and signs of data exfiltration. Look specifically for Cl0p-associated indicators of compromise.
-
Notify affected business partners and data owners. Because Cleo products facilitate file transfers between organizations, a compromise may have exposed data belonging to business partners, clients, and regulatory-protected individuals. Initiate incident response procedures including breach notification assessments and partner communications.
-
Implement defense-in-depth controls for file transfer infrastructure. Deploy network segmentation to isolate MFT servers, implement web application firewalls with rules blocking suspicious Autorun directory access, enable comprehensive logging and monitoring, and establish file integrity monitoring on the Autorun directory and other critical application paths.
Technical Details
CVE-2024-55956 is a critical unauthenticated remote code execution vulnerability in Cleo Harmony, VLTrader, and LexiCom file transfer products. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating maximum practical severity with no authentication or user interaction required.
The vulnerability exploits the Autorun directory feature present in all three Cleo products. The Autorun mechanism is designed to automatically process files placed in a designated directory, enabling automated file transfer workflows. By default, this directory is accessible and writable without authentication, and files placed in it are automatically imported and processed by the Cleo application.
The critical flaw is that the Autorun processing includes the ability to execute Bash scripts (on Linux/Unix systems) and PowerShell commands (on Windows systems). An unauthenticated attacker can leverage this by placing a malicious script file into the Autorun directory through the application's network-accessible interface. The Cleo application automatically detects the new file and executes it with the privileges of the application process, which typically runs with elevated permissions to manage file transfer operations and access the filesystem.
The attack requires only basic network access to the Cleo application. The attacker crafts a file containing arbitrary Bash or PowerShell commands, imports it through the application's default import mechanism into the Autorun directory, and the application executes the commands automatically. No authentication tokens, session cookies, or credentials are required at any stage of the exploitation chain.
Affected versions include Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24. The fix in version 5.8.0.24 addresses the authentication gap and restricts the Autorun directory's ability to execute arbitrary commands.
Frequently Asked Questions
What is CVE-2024-55956?
CVE-2024-55956 is a critical unauthenticated remote code execution vulnerability in Cleo Harmony, VLTrader, and LexiCom file transfer products. It allows attackers to execute arbitrary Bash or PowerShell commands on the host system by exploiting the default Autorun directory configuration without any authentication.
Is CVE-2024-55956 linked to ransomware?
Yes. CISA has confirmed a known ransomware association for this vulnerability. The Cl0p ransomware group has been linked to mass exploitation campaigns targeting Cleo file transfer products, following their established pattern of targeting managed file transfer platforms for data theft and extortion.
Which Cleo products are affected?
Three Cleo products are affected: Harmony, VLTrader, and LexiCom, all in versions before 5.8.0.24. All three share the same vulnerable Autorun directory functionality that enables unauthenticated command execution.
How does this compare to other MFT vulnerabilities like MOVEit?
CVE-2024-55956 follows the same pattern as the MOVEit Transfer (CVE-2023-34362) and GoAnywhere MFT (CVE-2023-0669) vulnerabilities: a critical unauthenticated flaw in a managed file transfer platform exploited by the Cl0p group for mass data exfiltration and extortion. Organizations using any MFT platform should review their security posture in light of this ongoing campaign pattern.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.