Cleo Managed File Transfer Zero-Day

THE THREAT

Update: Security patches to address this vulnerability were released by Cleo on December 12th. Organizations need to update to Cleo Harmony, VLTrader, and LexiCom versions 5.8.0.24 or higher.

On December 9th, Huntress disclosed the active exploitation of a vulnerability found in Cleo Managed File Transfer software. Additionally, Huntress confirmed that currently available security patches are ineffective at preventing exploitation.

CVE-2024-50623 (CVSS: 8.8) is an unrestricted file upload and download vulnerability that was disclosed publicly in October 2024. It impacts Cleo Harmony, Cleo VLTrader, and Cleo LexiCom. Exploitation of the vulnerability could enable a remote and unauthenticated threat actor to execute code. In response to the confirmation of real-world attacks and the ineffective security patches, Cleo has stated that a new CVE designation will be assigned, and security patches will be released shortly.

Until security patches are released and applied, it is critical that organizations do not expose vulnerable Cleo instances to the Internet.

What we’re doing about it

• eSentire MDR for Endpoint detects exploitation of this vulnerability
  • The eSentire Tactical Threat Response (TTR) team has created new detections within MDR for Endpoint
• eSentire MDR for Network detects exploitation of this vulnerability
  • The eSentire Tactical Threat Response (TTR) team has created new detections within MDR for Network 
• IP addresses associated with real-world exploitation are blocked via the eSentire Global Block List
• Threat Hunting for known signs of compromise across the client base is ongoing
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins to detect this vulnerability as they become available
• The eSentire Threat Response Unit (TRU) is actively tracking this topic for additional details and detection opportunities

What you should do about it

• When released, apply the applicable security patches provided by Cleo
• Until the required security patches are applied, organizations are strongly recommended to restrict access to all Cleo software by placing it behind a firewall
• Ensure Endpoint Detection and Response (EDR) capabilities are deployed to all workstations and servers to identify post-compromise activity

Additional information

As exploitation is ongoing, and the available security patches are ineffective, it is critical that impacted organizations take immediate steps to secure Cleo software. All versions of Cleo Harmony, Cleo VLTrader, and Cleo LexiCom, including the most recent release (5.8.0.21), are impacted by CVE-2024-50623. The publication of reports on the topic is likely to attract the attention of additional threat actors. These groups will attempt to achieve exploitation before organizations have the opportunity to apply security patches.

The earliest signs of exploitation of CVE-2024-50623 have been traced back to December 3rd, by Huntress. In real-world attacks, the vulnerability was exploited to deploy autorun files; these files invoke the “import” functionality, that is part of Cleo software. This led to a ZIP archive which was disguised as a .tmp file, containing a malicious XML file. This ultimately led to deployment of a JAR file, which contains “webshell-like functionality”. Threat actors were observed enumerating Active Directory (AD), in what was believed to be reconnaissance activity.

The final goal of real-world exploitation is unclear, but File Transfer Applications (FTA) have been heavily targeted in the past by groups like Cl0p (Lace Tempest). These attacks resulted in the theft of data for extortion. At the time of writing, recent activity has not been attributed to a specific threat actor.

References:

[1] https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-50623
[3] https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory-CVE-2024-50623
[4] https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending
[5] https://www.esentire.com/security-advisories/update-on-moveit-transfer-vulnerabilities