CVE-2024-55956: Cleo Harmony RCE Vulnerability

CVE-2024-55956 Overview

CVE-2024-55956 is a critical command injection vulnerability affecting Cleo's managed file transfer (MFT) products, including Cleo Harmony, VLTrader, and LexiCom. The vulnerability allows unauthenticated remote attackers to import and execute arbitrary Bash or PowerShell commands on the host system by exploiting default settings in the Autorun directory functionality.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network, enabling attackers to gain full control of affected systems. The flaw has been actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on vulnerable Cleo file transfer systems, leading to complete system compromise, data exfiltration, and potential ransomware deployment.

Affected Products

• Cleo Harmony versions before 5.8.0.24
• Cleo VLTrader versions before 5.8.0.24
• Cleo LexiCom versions before 5.8.0.24

Discovery Timeline

• 2024-12-13 - CVE-2024-55956 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-55956

Vulnerability Analysis

CVE-2024-55956 represents a command injection vulnerability (CWE-77) in Cleo's managed file transfer solutions. The vulnerability stems from improper handling of user-controlled input within the Autorun directory feature. By default, these products are configured with an Autorun directory that processes files automatically—a design choice intended for workflow automation that inadvertently creates a critical security gap.

The attack surface is significant: the vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. This allows attackers to achieve complete compromise of the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in the default configuration of the Autorun directory feature combined with insufficient input validation. When files are placed in the Autorun directory, the system processes them automatically, allowing the execution of embedded Bash or PowerShell commands without proper sanitization or authentication checks. This dangerous default configuration effectively transforms a legitimate automation feature into a remote code execution vector.

Attack Vector

The attack leverages the network-accessible Autorun directory functionality present in vulnerable Cleo products:

1. An unauthenticated attacker identifies a vulnerable Cleo Harmony, VLTrader, or LexiCom installation exposed to the network
2. The attacker crafts a malicious file containing Bash or PowerShell commands
3. The file is uploaded or imported to the Autorun directory
4. The Cleo application automatically processes the file and executes the embedded commands
5. Arbitrary code execution occurs with the privileges of the Cleo application service

This vulnerability has been actively exploited in the wild, with threat actors leveraging it for initial access into enterprise environments. According to the Huntress Threat Advisory, exploitation of this vulnerability has been observed targeting organizations running vulnerable Cleo installations.

Detection Methods for CVE-2024-55956

Indicators of Compromise

• Unexpected files appearing in the Autorun directory of Cleo installations
• Unusual process spawning from Cleo application services (e.g., cmd.exe, powershell.exe, or bash processes)
• Network connections to unknown external IP addresses originating from Cleo processes
• Unexplained file system modifications or new scheduled tasks created by the Cleo service account

Detection Strategies

• Monitor Cleo Autorun directories for any unauthorized or unexpected file additions
• Implement file integrity monitoring (FIM) on Cleo installation directories
• Configure SIEM alerts for command shell processes spawned by Cleo service processes
• Review web server and application logs for suspicious upload activity targeting Cleo endpoints

Monitoring Recommendations

• Enable detailed logging on all Cleo Harmony, VLTrader, and LexiCom installations
• Deploy network segmentation to limit exposure of Cleo services to trusted networks only
• Implement behavioral analysis to detect anomalous command execution patterns from MFT applications
• Regularly audit Autorun directory contents and application configurations

How to Mitigate CVE-2024-55956

Immediate Actions Required

• Upgrade all Cleo Harmony, VLTrader, and LexiCom installations to version 5.8.0.24 or later immediately
• If immediate patching is not possible, disable the Autorun directory feature or restrict network access to Cleo services
• Review Cleo systems for signs of compromise, including checking Autorun directories for malicious files
• Isolate vulnerable Cleo installations from the internet and untrusted networks until patching is complete

Patch Information

Cleo has released security updates addressing CVE-2024-55956 in version 5.8.0.24 for all affected products. Organizations should apply these patches as a matter of urgency given the active exploitation of this vulnerability. Detailed patch information is available in the Cleo Security Update advisory.

CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to remediate within defined timelines.

Workarounds

• Disable the Autorun directory functionality in Cleo product configurations until patches can be applied
• Implement strict firewall rules to prevent untrusted network access to Cleo services
• Remove or rename the Autorun directory and monitor for any attempts to recreate it
• Consider taking vulnerable Cleo instances offline until patches are deployed in high-risk environments

# Example: Restrict network access to Cleo services using firewall rules
# Block external access to Cleo services (adjust ports as needed)
iptables -A INPUT -p tcp --dport 5080 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 5443 -s 0.0.0.0/0 -j DROP

# Allow access only from trusted internal networks
iptables -A INPUT -p tcp --dport 5080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5443 -s 10.0.0.0/8 -j ACCEPT