erroneo.us
Search all guides⌘K

Security Digest · Oct 27, 2024 · Vulnerability · Other

Cleo MFT CVE-2024-50623 and CVE-2024-55956: Cl0p RCE

Unauthenticated file-write RCE in Cleo Harmony, VLTrader and LexiCom, mass-exploited by Cl0p in Dec 2024. Fixed in 5.8.0.24. Confirm the version, hunt old IOCs.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

The fix has existed since December 2024; the job now is proving every Cleo server runs 5.8.0.24 or later and that no host exposed during the Cl0p campaign still carries its backdoor.

Who must act: Anyone running Cleo Harmony, VLTrader or LexiCom below 5.8.0.24, and anyone whose Cleo server was internet-reachable between October and December 2024 without a completed compromise assessment.

Who can relax: Organizations that do not run Cleo products, or that patched to 5.8.0.24 or later and already hunted the published indicators back to early December 2024.

Affected
Cleo Harmony, VLTrader and LexiCom before 5.8.0.21 (CVE-2024-50623)
Cleo Harmony, VLTrader and LexiCom before 5.8.0.24, including 5.8.0.21 (CVE-2024-55956)
Fixed in
Cleo Harmony, VLTrader and LexiCom 5.8.0.24 (fixes both)
CVSS
9.8 (v3.1, NVD)
EPSS
98.6% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Cleo Harmony, VLTrader and LexiCom install, including desktop LexiCom clients, and record the running version.
  2. Upgrade anything below 5.8.0.24 to Cleo's current release.
  3. Keep the Cleo listener off the open internet; allow only known trading-partner addresses through the firewall.
  4. If you do not use Autorun, clear the Autorun Directory field under Configure, Options, Other.
  5. For any host exposed in late 2024, hunt the Huntress and Rapid7 indicators and rebuild it if you find them.

How to check if you are affected or compromised

  • Look in each install's hosts folder for main.xml or 60282967-dc91-40ef-a34c-38e992509c2c.xml containing an encoded PowerShell command.
  • Search the product logs (for example logs\LexiCom.xml and LexiCom.dbg) for autorun/healthchecktemplate.txt or autorun/healthcheck.txt.
  • Check EDR history for javaw.exe spawning PowerShell, and for systeminfo, whoami, net group /domain or nltest /domain_trusts run under the Cleo service.
  • Search firewall and proxy logs for the callback addresses Huntress and Rapid7 published, such as 176.123.5.126, 185.181.230.103 and 45.182.189.102.

What happened#

Cleo Harmony, VLTrader and LexiCom are managed file transfer products that companies use to swap files with trading partners. In October 2024, Cleo disclosed CVE-2024-50623, an unrestricted file upload and download flaw that "could lead to remote code execution." The record was published on October 27, and Cleo said version 5.8.0.21 fixed it. NVD scores it CVSS 3.1 9.8.

That fix did not hold. Huntress saw exploitation from December 3, 2024, with an uptick on December 8. It counted at least 10 compromised businesses, mostly in consumer products, food, trucking and shipping. Its researchers rebuilt the attack and ran it successfully against fully patched 5.8.0.21. Attackers wrote files into the product's autorun folder, which the software reads and executes automatically. Those files imported a host definition that ran PowerShell and pulled down Java (JAR) payloads with webshell-like functions. They then enumerated Active Directory.

Cleo acknowledged a new Autorun flaw on December 10, according to Rapid7, and shipped 5.8.0.24 around December 11. The issue became CVE-2024-55956 on December 13. Rapid7 later concluded it was a separate unauthenticated file-write bug in the same endpoint, not a patch bypass. CISA added CVE-2024-50623 to the KEV catalog on December 13 and CVE-2024-55956 on December 17. It marked both as used in ransomware campaigns. On December 15, BleepingComputer reported that the Cl0p extortion gang claimed both campaigns.

Who is affected#

Harmony, VLTrader and LexiCom before 5.8.0.21 are vulnerable to CVE-2024-50623. All three before 5.8.0.24, including 5.8.0.21, are vulnerable to CVE-2024-55956 (NVD). Cleo's advisories (October, December) sit behind a support login. Huntress notes that default installs go in C:\Harmony, C:\VLTrader or C:\LexiCom.

Do you really need to act?#

Most Cleo customers patched in December 2024, so a fresh emergency is unlikely today. The risk that remains is quieter. It comes from forgotten LexiCom clients and VLTrader boxes stuck below 5.8.0.24, and from hosts that were exposed during the campaign but never investigated. Cl0p stole data during the window, and Huntress and Rapid7 both saw persistence and lateral movement. Patching later did not remove a foothold. Treat this as a check-exposure item. Verify versions, then confirm someone actually hunted on any server that faced the internet between October and mid-December 2024.

What to do now#

  1. Find every Cleo install, servers and desktops alike, and record the version shown in the application or its startup log.
  2. Upgrade anything below 5.8.0.24 to Cleo's current release.
  3. Restrict the listener to known trading-partner IPs. Rapid7 recommends keeping these products behind a firewall.
  4. If you do not use Autorun, clear the Autorun Directory field under Configure, Options, Other, as Huntress describes.
  5. Rebuild and rotate credentials on any host where you find indicators.

How to tell if you were hit#

Huntress calls a main.xml or 60282967-dc91-40ef-a34c-38e992509c2c.xml in the hosts folder with an embedded encoded PowerShell command "a definitive indicator of compromise." On Windows, run Get-ChildItem C:\Harmony\hosts,C:\VLTrader\hosts,C:\LexiCom\hosts -Filter *.xml | Select-String -List powershell. Then run Select-String -Path C:\LexiCom\logs\* -Pattern 'autorun/health', adjusting paths to your install. Rapid7's release-note excerpt says 5.8.0.24 logs errors for exploit-related files it removes at startup, so review the first logs written after the upgrade. In EDR data, look for javaw.exe spawning PowerShell, for nltest /domain_trusts, and for connections to 176.123.5.126, 185.181.230.103 or 45.182.189.102. Hunt from at least December 3, 2024, and from October if you ran versions before 5.8.0.21.

Timeline#

  • — CVE-2024-50623 is published. Cleo lists 5.8.0.21 as the fix.
  • — Earliest exploitation Huntress observed, including against 5.8.0.21.
  • — Huntress publishes its advisory.
  • — Version 5.8.0.24 appears, per Rapid7.
  • — CVE-2024-55956 is assigned. CVE-2024-50623 is added to KEV.
  • — Cl0p claims the attacks to BleepingComputer.
  • — CVE-2024-55956 is added to KEV, with a January 7, 2025 federal deadline.

Vulnerability records

  • CVE-2024-50623 · KEV 2024-12-13 · In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to…
  • CVE-2024-55956 · KEV 2024-12-17 · In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cleo — Product Security Advisory (CVE-2024-50623) support.cleo.com
  2. Cleo — Product Security Advisory (CVE-2024-55956) support.cleo.com
  3. CVE record — CVE-2024-50623 cve.org
  4. CVE record — CVE-2024-55956 cve.org
  5. NVD — CVE-2024-50623 nvd.nist.gov
  6. NVD — CVE-2024-55956 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-50623 cisa.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2024-55956 cisa.gov
  9. Huntress — Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild huntress.com
  10. Rapid7 — Widespread Exploitation of Cleo File Transfer Software (CVE-2024-55956) rapid7.com

Coverage and analysis

  1. BleepingComputer — Clop ransomware claims responsibility for Cleo data theft attacks bleepingcomputer.com