erroneo.us
Search all guides⌘K

Security Digest · Jan 8, 2025 · Vulnerability · Other

SimpleHelp CVE-2024-57727: Ransomware Entry via File Read

Unauthenticated file download in SimpleHelp 5.5.7 and earlier, used by ransomware crews since January 2025. Fixed in 5.5.8; run 5.5.16+ and rotate secrets.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Patched since January 2025, but this one-request file read was the door several ransomware crews used into MSPs and their customers; any SimpleHelp server that was online below 5.5.8 should be treated as having leaked its config file and secrets, and every server should now be on 5.5.16 or later.

Who must act: Anyone who runs a SimpleHelp server, or whose endpoints connect to one run by an MSP or bundled in vendor software, if that server was below 5.5.8 (or an unpatched 5.4.10 or 5.3.9) while reachable from the internet.

Who can relax: Teams with no SimpleHelp anywhere, and owners of servers that were patched in January 2025, now run 5.5.16 or later, limit logins to known addresses and show no unknown sessions or tokens.

Affected
SimpleHelp 5.5.7 and all earlier releases
SimpleHelp 5.4.10 and 5.3.9 without Patch 070125
Fixed in
SimpleHelp 5.5.8 (Jan 8, 2025)
Patch 070125 for 5.4.10 (Jan 8) and 5.3.9 (Jan 13, 2025)
Recommended now: 5.5.16 or later, which also fixes CVE-2026-48558
CVSS
9.1 (v3.1, CISA-ADP)
EPSS
96.8% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every SimpleHelp server you run or depend on, including MSP-hosted and vendor-embedded ones, and check its version at /allversions.
  2. Upgrade to 5.5.16 or later; 5.5.8 or Patch 070125 only covers the January 2025 bugs.
  3. If a server was internet-facing below 5.5.8, assume serverconfig.xml was stolen: change the SimpleHelpAdmin and technician passwords, recreate API tokens, rotate LDAP bind credentials and OIDC client secrets, and re-enroll MFA.
  4. Restrict technician, admin and API logins to approved IP addresses, and disable SimpleHelpAdmin in favor of named accounts.
  5. On endpoints, confirm every ConnectTo line in serviceconfig.xml points to a server you own or trust.

How to check if you are affected or compromised

  • On 5.5.8 and later, '[WebDownloadServer] Insecure request' log entries mean someone probed for this file-read bug.
  • Review technician logins and the History tab for sessions or source IPs you do not recognize, especially since January 2025.
  • Search endpoints for three-letter executables such as aaa.exe or bbb.exe created after January 2025, which CISA lists as an indicator.
  • Look for endpoints registered to an unapproved SimpleHelp server, the first sign Arctic Wolf saw in January 2025.

What happened#

SimpleHelp is remote support software that managed service providers (MSPs) and IT teams host themselves. On January 6, 2025, Horizon3.ai reported three flaws to SimpleHelp. The vendor shipped 5.5.8 and a 5.4.10 patch on January 8 and a 5.3.9 patch on January 13. Our companion brief covers the other two, CVE-2024-57726 (technician-to-admin escalation) and CVE-2024-57728 (zip-slip upload). This one, CVE-2024-57727, needs no login at all.

The CVE record describes path traversals that let an unauthenticated attacker download arbitrary files from the SimpleHelp host with crafted HTTP requests. Horizon3 says the key target is configuration/serverconfig.xml. It holds hashed passwords for SimpleHelpAdmin and local technicians and, depending on setup, LDAP credentials, OIDC client secrets, API keys and TOTP seeds used for MFA. Those secrets are encrypted with a hardcoded key. Horizon3 called the bugs "trivial to reverse and exploit."

Attacks followed within weeks. Roughly a week after Horizon3 went public, Arctic Wolf reported intrusions through SimpleHelp. It linked them to the new flaws with medium confidence, per BleepingComputer, which also cited 580 vulnerable servers exposed online. CISA added the CVE to the KEV catalog on February 13, 2025, and marks ransomware use as known. On June 4, 2025, the updated Play ransomware advisory said multiple ransomware groups, "including initial access brokers with ties to Play ransomware operators," exploited it at many US entities. On June 12, AA25-163A said ransomware actors likely used it to reach customers of a utility billing software provider and described a pattern of such attacks since January 2025.

Who is affected#

SimpleHelp 5.5.7 and earlier, per the vendor's notice. 5.4.10 and 5.3.9 are fixed only with Patch 070125. NVD scores the bug 7.5 for the file read alone. CISA's enrichment on the CVE record scores it 9.1, rating the integrity impact high as well.

Do you really need to act?#

Only if you run or rely on a server that missed the January 2025 patch. Several crews used that window. Upgrading does not change secrets that already leaked, so a server that was exposed while unpatched needs credential rotation and a hunt. Also, 5.5.8 is no longer enough. CVE-2026-48558, an OIDC login bypass in 5.5.15 and earlier, joined KEV on June 29, 2026. SimpleHelp's Security Notice 2026-05 points 5.5.x users to 5.5.16.

What to do now#

  1. Check each server's version with curl -s https://support.example.com/allversions, or read the top of SimpleHelp/configuration/serverconfig.xml.
  2. Upgrade to 5.5.16 or later.
  3. For any server exposed below 5.5.8, rotate everything in serverconfig.xml: admin and technician passwords, API tokens, LDAP bind accounts, OIDC client secrets and MFA enrollments.
  4. Restrict technician, admin and API logins to approved addresses, and disable SimpleHelpAdmin, as the vendor advises.
  5. Ask any MSP or software vendor that connects to you over SimpleHelp for its version and patch date.

How to tell if you were hit#

On 5.5.8 and later, the vendor says [WebDownloadServer] Insecure request log lines mean a client probed for this bug. Run grep -rF "Insecure request" over the server's log folder. Review technician logins and the History tab for unknown sessions or source IPs. On endpoints, open JWrapper-Remote Access/JWAppsSharedConfig/serviceconfig.xml and check every <ConnectTo line. Look for three-letter executables such as aaa.exe created after January 2025. If you find any of this, isolate the machines and bring in incident response.

Timeline#

  • — Horizon3 reports the flaws to SimpleHelp.
  • — SimpleHelp releases 5.5.8 and the 5.4.10 patch. The 5.3.9 patch follows on January 13.
  • — The CVE record is published.
  • — Arctic Wolf's report of in-the-wild intrusions is covered by BleepingComputer.
  • — CISA adds CVE-2024-57727 to KEV, with a March 6 deadline.
  • — The Play ransomware advisory is updated to name this CVE.
  • — CISA publishes AA25-163A.
  • — CVE-2026-48558 joins KEV.

Vulnerability records

  • CVE-2024-57727 · KEV 2025-02-13 · SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. SimpleHelp — Security vulnerabilities in SimpleHelp 5.5.7 and earlier simple-help.com
  2. CVE record — CVE-2024-57727 cve.org
  3. NVD — CVE-2024-57727 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2024-57727 cisa.gov
  5. Horizon3.ai — Critical vulnerabilities in SimpleHelp remote support software horizon3.ai
  6. CISA — AA25-163A: Ransomware actors exploit unpatched SimpleHelp RMM to compromise utility billing software provider cisa.gov
  7. FBI, CISA, ASD's ACSC — AA23-352A: #StopRansomware: Play Ransomware (updated Jun 4, 2025) cisa.gov
  8. SimpleHelp — Security Notice 2026-05 simple-help.com
  9. CVE record — CVE-2026-48558 cve.org

Coverage and analysis

  1. BleepingComputer — Hackers exploiting flaws in SimpleHelp RMM to breach networks bleepingcomputer.com