CVE-2024-57728: SimpleHelp Path Traversal Vulnerability

SimpleHelp contains a path traversal vulnerability that lets an administrator upload a specially crafted zip file and write arbitrary files to any location on the server file system. The flaw can be used to place executable code that then runs with the privileges of the SimpleHelp server process. Because the issue is already known to be used by ransomware operators, any internet-facing or remotely accessible SimpleHelp instance should be treated as high priority for review.

How it works

The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory. An authenticated administrator uploads a zip archive whose entries contain path traversal sequences. When the archive is extracted, files are written outside the intended directory, allowing placement of code in locations the server process can later execute.

Am I affected? How to find it in your systems

Inventory every deployment of SimpleHelp, including on-premises servers and any instances running in cloud environments. Confirm the exact version and configuration against the vendor advisory, because only the vendor can state which builds contain the flaw. Review administrative accounts and any logs or telemetry that record zip-file uploads or file-extraction events. Look for unexpected files appearing outside normal application directories or changes to startup scripts and service binaries.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, review administrative access controls and limit the number of users who can perform file-upload operations. Follow any additional hardening steps listed by the vendor for this class of path-traversal issue.

If you can't patch immediately

• Apply mitigations exactly as described in the vendor instructions.
• For cloud-hosted instances, follow the requirements of CISA BOD 22-01.
• If mitigations cannot be applied, discontinue use of the product until a fix is in place.
• Restrict network access to the SimpleHelp server so that only trusted administrative networks can reach it.
• Monitor file-system and process-creation events on the host for signs of unexpected file writes or new executables.

If your data may have been exposed

Because this vulnerability is known to be used in ransomware campaigns, assume that successful exploitation could lead to data theft or encryption. Run a free exposure scan of your organization’s email domains against known breach data to determine whether credentials or other information have already appeared in public dumps.