Unauthenticated File Upload in Cleo Managed File Transfer Suite (CVE‑2024‑55956) Threatens Enterprise Data Flows
What It Is
Cleo’s Harmony, VLTrader, and LexiCom products expose an unrestricted file‑upload endpoint. The flaw allows an unauthenticated actor to place a file in the default Autorun directory, which the host automatically executes as a Bash or PowerShell script.
Exploitability
- Publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
- Proof‑of‑concept code has been shared in open‑source security forums.
- CVSS v3.1 base score: 7.8 (High) – Network‑accessible, no authentication required, remote code execution.
Affected Products
- Vendor: Cleo
- Products: Cleo Harmony, Cleo VLTrader, Cleo LexiCom (all managed file‑transfer solutions).
Why It Matters for Compliance & Audit Readiness
The vulnerability directly undermines vendor‑management controls and access‑control assurances required by frameworks such as NIST CSF, ISO 27001, and SOC 2.
- Control Mapping: The flaw bypasses “Restrict Upload of Executable Content” (AC‑3) and “Secure Configuration” (PR‑2) controls.
- Evidence of Due Diligence: Demonstrating that you have validated third‑party software configurations, logged file‑upload activity, and applied compensating controls provides a defensible audit trail.
- Continuous Monitoring: Detecting anomalous file‑upload events and autorun executions is a key indicator of compromise (IoC) that must be integrated into SIEM and UEBA processes.
Recommended Actions
- Map the Gap: Update your vendor‑management control matrix to reflect the missing upload‑validation control for Cleo products.
- Patch Immediately: Apply Cleo’s security update (released 2024‑09‑xx) that enforces file‑type validation and disables the default Autorun directory.
- Hardening:
- Disable the Autorun feature or restrict it to a non‑executable directory.
- Enforce least‑privilege service accounts for the file‑transfer services.
- Log & Monitor: Enable detailed logging of all file‑upload requests and set alerts for execution of newly uploaded scripts.
- Evidence Capture: Archive logs, patch‑deployment records, and configuration snapshots to demonstrate remediation during audit cycles.
- Review Contracts: Verify that your service‑level agreements (SLAs) with Cleo include timely vulnerability disclosure and remediation commitments.
Source: https://nvd.nist.gov/vuln/detail/CVE-2024-55956