CVE-2024-50623 — Cleo Harmony / VLTrader / LexiCom RCE

CVE-2024-50623 — Cleo Harmony / VLTrader / LexiCom RCE

TL;DR: Cleo’s managed-file-transfer (MFT) products — Harmony, VLTrader, LexiCom — exposed an autorun endpoint that took uploaded files and executed them in the host’s scripting context, with no auth. Disclosed late 2024; exploited by Clop and other ransomware crews shortly after. A repeating MFT pattern: vendor ships “automation” features that turn the product into a code-execution surface. Companion to cve-2024-1709-screenconnect-auth-bypass and reading-public-pocs-effectively.

Why this matters

  • Cleo is widely used by retail, logistics, and supply-chain operators — a high-value MFT target similar to MOVEit (2023).
  • The bug pattern repeats across MFT products (MOVEit, GoAnywhere, Cleo, Accellion). Worth studying as a class, not a one-off.
  • Exploited by Clop ransomware crew for mass-extortion; the resulting incident wave landed on dozens of large organisations.

The bug

Cleo’s products expose an autorun directory where placing a file triggers automatic processing. Files dropped into specific paths were processed without authentication.

The processing included:

  • ZIP extraction (with path-traversal risk).
  • XML configuration parsing (often a chain into deserialisation or XXE).
  • Inline script execution via the bundled scripting engine.

The endpoint that accepted uploads was reachable pre-auth on default deployments.

Exploitation in the wild

Clop’s crew dropped malicious payloads to the autorun path via the unauthenticated upload, then triggered execution. They deployed a custom backdoor used to enumerate and exfiltrate file shares accessible by the MFT product’s service account.

The pattern: MFT account has wide read access → backdoor in MFT yields wide data access.

Initial patch and bypass

Cleo’s first patch (October 2024) was insufficient. Researchers (Huntress, Rapid7) demonstrated bypasses within days. A second patch in December 2024 closed the variants.

The lesson is identical to Ivanti’s: first patch isn’t always enough. Verify with current threat intel.

Workflow to study

  1. Acquire a vulnerable Cleo Harmony build.
  2. Map the autorun directory paths and the endpoints that write to them.
  3. Drop a benign script to the autorun path via the upload endpoint.
  4. Observe automatic execution.
  5. Compare against the patched version’s directory handler.

Public reproductions: Huntress, Rapid7, watchTowr.

Defensive lessons

  • MFT products should not be internet-exposed. They’re frequently CDE-adjacent and PII-heavy. Front them with VPN or zero-trust proxy.
  • Autorun directories are RCE surfaces. Audit any product feature that “automatically runs uploaded files” — that is the definition of unauth RCE if the upload is unauth.
  • Service-account scope should be minimal. Cleo’s service account often had domain-wide read; trim per-customer / per-folder.
  • Telemetry: outbound to non-business addresses from MFT hosts is a strong indicator.

Recovery posture

  • Patch to fully fixed version (post-December 2024).
  • Audit the autorun directory and inbound/outbound transfer logs.
  • Rotate service-account credentials and any business-partner shared keys.
  • Notify business partners whose data was processed by the affected instance — supply chain reporting requirements often apply.
  • CVE-2023-34362 (MOVEit Transfer SQLi → RCE — Clop, 2023).
  • CVE-2024-0204 (Fortra GoAnywhere — auth bypass to admin).
  • CVE-2024-3400 (PAN GlobalProtect — different product class but same operator pivot pattern).

Pattern: business-critical file-transfer products + perimeter-facing + complex parsing. The class generates a major CVE annually.

References