High‑Risk Unrestricted File Upload in Cleo Managed File Transfer Suite (CVE‑2024‑50623) Enables Remote Code Execution
What It Is
Cleo’s Harmony, VLTrader, and LexiCom managed‑file‑transfer applications allow an attacker to upload arbitrary files without proper validation. The flaw can be leveraged to execute code on the server with elevated privileges.
Exploitability
The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation. Public proof‑of‑concept code exists and the CVSS base score is rated High.
Affected Products
- Cleo Harmony
- Cleo VLTrader
- Cleo LexiCom
All are part of Cleo’s managed file‑transfer product line.
Why It Matters for Compliance & Audit Readiness
Unrestricted file upload bypasses core access‑control safeguards, undermining continuous control monitoring and the evidentiary trail required for audit readiness. Organizations must demonstrate due diligence in vendor‑management controls and maintain a defensible mapping of file‑transfer services to security policies (e.g., NIST CSF PR.AC‑1, PR.IP‑1). Failure to remediate can expose gaps in the control‑assurance framework and jeopardize compliance with data‑protection regulations that mandate protection against unauthorized code execution.
Recommended Actions
- Patch Immediately – Apply the vendor‑released security update for all affected Cleo products.
- Validate File‑Upload Controls – Ensure strict file‑type validation, content‑type checks, and sandboxing are enforced.
- Update Vendor‑Management Records – Document the vulnerability, remediation timeline, and evidence of patch deployment in your vendor‑risk register.
- Enhance Monitoring – Deploy file‑integrity monitoring and alerting for anomalous upload activity.
- Map to Controls – Align remediation steps with your existing access‑control and change‑management controls to maintain a continuous audit trail.
Source: https://nvd.nist.gov/vuln/detail/CVE-2024-50623