CVE-2024-57728
SimpleHelp Path Traversal Vulnerability
Description
CVE-2024-57728 is a HIGH severity "zip slip" path traversal vulnerability in SimpleHelp remote support software (versions 5.5.7 and earlier) with a CVSS 3.1 score of 7.2. The flaw lets authenticated admin users upload a crafted ZIP archive whose entries contain ../ path components; when the SimpleHelp server extracts the archive, the entries are written to arbitrary locations on the host filesystem rather than being constrained to a safe extraction directory. This is a classic Zip Slip primitive that translates directly into arbitrary code execution on the SimpleHelp server. CISA added CVE-2024-57728 to the KEV catalog on April 24, 2026 (deadline May 8, 2026), and the SimpleHelp vulnerability cluster has been linked by Microsoft and Trend Micro to Storm-1175 / DragonForce ransomware campaigns. With an EPSS score of 0.593 (98th percentile), exploitation is widespread.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| simple-help | simplehelp | < 5.5.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier(Vendor Advisory)
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57728(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/(Technical Description)
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce(Third Party Advisory)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal is a vulnerability that occurs when software uses external input to construct a pathname intended to identify a file or directory beneath a restricted parent directory, but fails to neutralize sequences such as ../ that allow the path to resolve outside that directory. In SimpleHelp ≤ 5.5.7, the file derived from a ZIP archive entry name is treated as the destination path during extraction, and ../ segments embedded in entry names are not stripped or validated against the intended extraction root.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access — also known as Link Following or Symlink Attack — occurs when software accesses a file through a path that can be modified by an attacker who creates symbolic links pointing at unintended locations. In the SimpleHelp Zip Slip flaw, an attacker can additionally embed symbolic-link entries inside the crafted archive; when the server extracts a subsequent file with the same name, the link redirects the write to a location of the attacker's choosing. The combination of CWE-22 and CWE-59 makes the bypass robust against naïve filtering of .. strings alone.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2024-57728 carries a CVSS 3.1 score of 7.2 (HIGH) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — exploitable over the network with low complexity, no user interaction, and High impact across Confidentiality, Integrity, and Availability. PR:H reflects that the attacker must be authenticated as an admin user, but in SimpleHelp deployments — which are typically internet-facing remote-support consoles — admin access is the highest-value target and frequently chained with the related authorization bypass CVE-2024-57726 (also added to KEV the same day) to escalate from low-privileged technician to full admin. Once the path traversal/zip slip is triggered, the attacker can drop a payload anywhere the SimpleHelp server process can write — including the SimpleHelp installation directory, web-served paths, or system startup locations — and execute arbitrary code in the context of the SimpleHelp server user. Because SimpleHelp manages persistent connections to remote endpoints, code execution on the server is a stepping stone to lateral movement across all clients reachable via the platform — which is exactly how DragonForce and Storm-1175 operators have abused SimpleHelp during ransomware operations.
Exploit Maturity
Active Exploitation: CISA added CVE-2024-57728 to the KEV catalog on April 24, 2026, with a remediation deadline of May 8, 2026. Public Exploits: Detailed technical analysis is available from Horizon3.ai — see "Critical Vulnerabilities in SimpleHelp Remote Support Software" — and the SimpleHelp vendor advisory at simple-help.com. Threat Actor Linkage: Microsoft Threat Intelligence has documented Storm-1175 leveraging vulnerable web-facing SimpleHelp instances during high-tempo Medusa ransomware operations, and Trend Micro's DragonForce ransomware spotlight connects the SimpleHelp CVE cluster to DragonForce intrusions. Exploitation Probability: With an EPSS score of 0.593 (98th percentile), the model rates the probability of continued exploitation as near-certain. Chaining Potential: CVE-2024-57728 is most damaging when chained with the related CVE-2024-57726 (Missing Authorization), which lets a low-privileged technician escalate to admin — defenders should patch both CVEs simultaneously.
Remediation
- Upgrade SimpleHelp to 5.5.8 or later. This release patches CVE-2024-57728 along with the chained CVE-2024-57726 and CVE-2024-57727. Refer to the SimpleHelp security advisory for upgrade steps and mandatory post-upgrade configuration changes.
- Restrict admin and technician accounts. Audit the SimpleHelp user list for unused or default admin accounts. Enforce strong, unique passwords and require MFA for all administrators. Because the chained CVEs allow technician-to-admin escalation, the technician role must also be tightly controlled.
- Remove or restrict internet exposure. SimpleHelp is most commonly attacked when its admin/technician console is exposed directly to the internet. Place the server behind a VPN or restrict access to trusted IP ranges.
- Hunt for prior compromise. Inspect the SimpleHelp installation directory (and any directories writable by the SimpleHelp service account) for unexpected files dropped after January 2025. Review HTTP access logs for archive uploads with crafted entry names. Check SimpleHelp audit logs for new admin accounts or API keys created around the time of suspicious activity. The Horizon3.ai write-up and Microsoft/Trend Micro reports include indicators of compromise for the linked ransomware actors.
- Long-term hardening. Apply the CWE-22 and CWE-59 mitigation principles when deploying any archive-extraction functionality — canonicalize entry paths against the extraction root before writing, strip or reject symbolic-link entries, and run extraction processes under least-privilege accounts isolated from web-served and system directories.
Technical Details
CVE-2024-57728 is a Zip Slip path traversal flaw in SimpleHelp remote support software ≤ 5.5.7. When an admin user uploads a ZIP archive through the SimpleHelp admin interface, the server extracts the archive into a working directory; however, the extraction code uses each archive entry's name verbatim as part of the destination path without canonicalizing the result against the intended extraction root. By embedding ../ segments — or, more robustly, symbolic-link entries (CWE-59) — in the archive, the attacker steers individual extracted files to arbitrary locations on the host filesystem. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms that the request is delivered over the network with low complexity, no user interaction is required after upload, and the impact is uniformly High across Confidentiality, Integrity, and Availability. PR:H reflects the requirement for an admin session, but this hurdle collapses once CVE-2024-57726 (Missing Authorization) is chained: a low-privileged technician escalates to admin, then triggers the Zip Slip to deploy a payload — typically a JAR, JSP, or shell script — into a directory where it will be executed by the SimpleHelp server process. The end-state is arbitrary code execution as the SimpleHelp server user, which on most installations has broad access to the server filesystem and the connected remote-endpoint inventory.
Frequently Asked Questions
Is CVE-2024-57728 being actively exploited?
Yes. CISA added CVE-2024-57728 to the KEV catalog on April 24, 2026, and Microsoft and Trend Micro have linked the SimpleHelp CVE cluster to active Storm-1175 / DragonForce ransomware operations. The EPSS score of 0.593 (98th percentile) indicates near-certain ongoing exploitation activity.
What products are affected by CVE-2024-57728?
SimpleHelp remote support software versions 5.5.7 and earlier are vulnerable. The fix is available in SimpleHelp 5.5.8. Both server installations and any out-of-band downloaded server packages must be upgraded.
How do I fix CVE-2024-57728?
Upgrade to SimpleHelp 5.5.8 or later, audit and harden admin/technician accounts (MFA, password rotation, least privilege), remove internet exposure of the admin console, and hunt for prior compromise indicators in the SimpleHelp installation directory and access logs. Patch CVE-2024-57726 and CVE-2024-57727 simultaneously to close the full exploitation chain.
How severe is CVE-2024-57728?
CVE-2024-57728 is rated HIGH (CVSS 3.1 score 7.2) with full High impact on Confidentiality, Integrity, and Availability. Combined with KEV listing, EPSS 98th-percentile exploitation probability, and confirmed ransomware actor abuse, defenders should treat any unpatched SimpleHelp deployment as a critical-priority remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.