CVE-2024-50623: Cleo Multiple Products Unrestricted File Upload Vulnerability

CVE-2024-50623 is an unrestricted file upload and download vulnerability affecting Cleo managed file transfer products: Harmony, VLTrader, and LexiCom. The flaw can allow remote code execution with elevated privileges. It matters because these systems often sit at the edge of enterprise networks to move sensitive files between partners and internal systems, and the vulnerability is known to have been used in ransomware activity. Defenders should treat any exposed instance as high priority and confirm all version and configuration details against the vendor advisory.

How it works

The weakness is classified as CWE-434, unrestricted upload of a file with a dangerous type. In managed file transfer products, upload and download functions are core features. When those functions do not properly validate or restrict the type, location, or content of files an unauthenticated or low-privilege user can submit, an attacker can place a malicious file on the server. Once the file is present, the same or a related download or execution path can be abused to run code under the privileges of the service account, which is frequently elevated. Public detail on the exact request format or payload is limited; treat any description of exploit mechanics as general for this class and verify against the vendor advisory.

Am I affected? How to find it in your systems

Cleo Harmony, VLTrader, and LexiCom are typically deployed as on-premises or private-cloud managed file transfer gateways. They commonly run on Windows or Linux servers that are reachable from partner networks or the internet on dedicated ports. Inventory steps:

• Search asset management, CMDB, and vulnerability scanners for the product names Cleo Harmony, VLTrader, and LexiCom.
• Review listening services and process lists on servers that handle external file exchange; look for Cleo-related binaries or service names.
• Check configuration management and software inventory tools for any Cleo installation packages.
• Confirm the exact product version and patch level against the vendor advisory; do not rely on generic version ranges.

Telemetry signs of exploitation for this class include unexpected file writes under the application’s upload or temporary directories, new or modified executable or script files, anomalous outbound connections from the MFT host, and authentication or process-creation events that do not match normal transfer patterns. Correlate web or application logs for unusual upload requests if those logs are available.

How to remediate

Apply the vendor-supplied update or mitigation instructions for CVE-2024-50623 as the primary action. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After patching:

• Restart the affected services only after confirming the update is correctly applied.
• Re-validate that unrestricted upload paths are no longer reachable without proper authentication and file-type controls.
• Review and tighten the service account privileges used by the MFT application so that successful code execution yields the least possible access.
• Rotate any credentials or certificates that may have been stored or used by the product if compromise is suspected.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the MFT hosts so they are reachable only from known partner IP ranges and internal management networks; block direct internet access where possible.
• Place a web application firewall or reverse proxy in front of the service and apply virtual-patch rules that restrict file-upload endpoints to expected content types and authenticated sessions.
• Disable any unnecessary upload, download, or remote-administration features that are not required for business operations.
• Increase monitoring: alert on new file creation in application directories, unexpected process launches, and lateral-movement indicators originating from the MFT server.
• If mitigations cannot be implemented and the risk is unacceptable, follow the CISA guidance to discontinue use of the product until a fix is available.

If your data may have been exposed

Actively exploited vulnerabilities in managed file transfer products have led to ransomware incidents and data theft. If logs or other indicators suggest the vulnerability was used against your environment, treat the host and any connected systems as potentially compromised, preserve forensic evidence, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization have already appeared in public dumps.