CVE-2024-50623 — Cleo File Transfer RCE

Key facts

CVE-2024-50623 (Cleo) is a Critical (9.8) vulnerability: Cleo File Transfer RCE. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-13), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2024-50623 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-13), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2025-01-03. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2024-50623
Severity	Critical (9.8)
CISA KEV	Actively exploited (added 2024-12-13) · ransomware
Vendor	Cleo
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-50623/

Details

CVE-2024-50623 (Cleo) is a Critical (9.8) vulnerability: Cleo File Transfer RCE. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Description

Unrestricted file upload RCE

Affected Versions

• Cleo Harmony LexiCom VLTrader

Mitigation

1. Apply vendor patches immediately
2. Restrict network access to management interfaces
3. Implement network monitoring

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• NVD Entry

Detection and prevention

Ready-to-deploy defensive rules for CVE-2024-50623, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2024-50623 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-50623 - Cleo File Transfer Snort Detection Rules
# Severity: Critical (CVSS 9.8)

# Detect access to Synchronize endpoint
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cleo Synchronize Endpoint Access";
    flow:to_server,established;
    content:"/Synchronize"; http_uri;
    classtype:web-application-attack;
    sid:2024506231;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect PUT request to Synchronize
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cleo File Upload via PUT";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"/Synchronize"; http_uri;
    classtype:web-application-attack;
    sid:2024506232;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect autorun directory access
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cleo Autorun Directory Access";
    flow:to_server,established;
    content:"/autorun/"; http_uri;
    classtype:web-application-attack;
    sid:2024506233;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect JSP file upload
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cleo JSP File Upload";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:".jsp"; http_uri;
    classtype:web-application-attack;
    sid:2024506234;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect malicious XML in upload
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Malicious XML Payload";
    flow:to_server,established;
    content:"<?xml"; nocase;
    content:"<command"; nocase; distance:0;
    classtype:web-application-attack;
    sid:2024506235;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect Cl0p ransomware payload patterns
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cl0p Ransomware Payload Pattern";
    flow:to_server,established;
    content:"/Synchronize"; http_uri;
    pcre:"/(powershell|certutil|bitsadmin|cmd\.exe)/i";
    classtype:trojan-activity;
    sid:2024506236;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect webshell upload to Cleo
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Webshell Upload Attempt";
    flow:to_server,established;
    content:"PUT"; http_method;
    pcre:"/\.(jsp|jspx|war|jar|aspx|php|sh)(\?|$)/Ui";
    content:"Runtime"; nocase;
    classtype:web-application-attack;
    sid:2024506237;
    rev:1;
    metadata:cve CVE-2024-50623, severity critical;
)

# Detect Cleo product fingerprinting
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-50623 Cleo Product Reconnaissance";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/healthcheck"; http_uri;
    detection_filter:track by_src, count 5, seconds 60;
    classtype:attempted-recon;
    sid:2024506238;
    rev:1;
    metadata:cve CVE-2024-50623, severity medium;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-50623 - Cleo File Transfer YARA Detection Rules
 * Severity: Critical (CVSS 9.8)
 * Associated with Cl0p ransomware campaigns
 */

rule CVE_2024_50623_Exploit_Request {
    meta:
        description = "Detects CVE-2024-50623 Cleo exploitation requests"
        author = "Security Research"
        date = "2024-12-10"
        cve = "CVE-2024-50623"
        severity = "critical"

    strings:
        // Vulnerable endpoints
        $uri1 = "/Synchronize" ascii wide nocase
        $uri2 = "/autorun/" ascii wide nocase
        $uri3 = "/healthcheck" ascii wide nocase

        // HTTP methods for upload
        $method1 = "PUT /Synchronize" ascii wide
        $method2 = "POST /Synchronize" ascii wide
        $method3 = "PUT /autorun/" ascii wide

        // File extensions
        $ext1 = ".jsp" ascii wide nocase
        $ext2 = ".jspx" ascii wide nocase
        $ext3 = ".war" ascii wide nocase
        $ext4 = ".xml" ascii wide nocase

    condition:
        (any of ($uri*) and any of ($method*)) or
        (any of ($method*) and any of ($ext*))
}

rule CVE_2024_50623_Malicious_XML {
    meta:
        description = "Detects malicious XML payloads for Cleo exploitation"
        author = "Security Research"
        date = "2024-12-10"
        cve = "CVE-2024-50623"
        severity = "critical"

    strings:
        $xml_header = "<?xml" ascii wide nocase

        // Malicious XML elements
        $cmd1 = "<command>" ascii wide nocase
        $cmd2 = "<execute>" ascii wide nocase
        $cmd3 = "<shell>" ascii wide nocase
        $cmd4 = "<script>" ascii wide nocase
        $cmd5 = "cmd.exe" ascii wide nocase
        $cmd6 = "powershell" ascii wide nocase
        $cmd7 = "/bin/sh" ascii wide nocase
        $cmd8 = "/bin/bash" ascii wide nocase

        // Schedule/autorun patterns
        $auto1 = "<schedule>" ascii wide nocase
        $auto2 = "autorun" ascii wide nocase

    condition:
        $xml_header and (any of ($cmd*) or any of ($auto*))
}

rule CVE_2024_50623_JSP_Webshell {
    meta:
        description = "Detects JSP webshells uploaded via CVE-2024-50623"
        author = "Security Research"
        date = "2024-12-10"
        cve = "CVE-2024-50623"
        severity = "critical"

    strings:
        $jsp1 = "<%@ page" ascii wide nocase
        $jsp2 = "<%" ascii wide

        // Dangerous JSP functions
        $func1 = "Runtime.getRuntime().exec" ascii wide
        $func2 = "ProcessBuilder" ascii wide
        $func3 = "getParameter" ascii wide
        $func4 = "FileOutputStream" ascii wide
        $func5 = "BufferedReader" ascii wide

        // Base64/encoded payloads
        $enc1 = "Base64.getDecoder" ascii wide
        $enc2 = "base64," ascii wide nocase

    condition:
        any of ($jsp*) and (2 of ($func*) or any of ($enc*))
}

rule CVE_2024_50623_Cl0p_Payload {
    meta:
        description = "Detects Cl0p ransomware payloads associated with CVE-2024-50623"
        author = "Security Research"
        date = "2024-12-10"
        cve = "CVE-2024-50623"
        severity = "critical"
        malware_family = "Cl0p"

    strings:
        // Cl0p indicators
        $cl0p1 = "Cl0p" ascii wide nocase
        $cl0p2 = ".Cl0p" ascii wide
        $cl0p3 = "CLOP" ascii wide

        // Ransomware behaviors
        $ransom1 = "README" ascii wide
        $ransom2 = "DECRYPT" ascii wide nocase
        $ransom3 = ".onion" ascii wide

        // Exfiltration patterns
        $exfil1 = "curl " ascii wide
        $exfil2 = "wget " ascii wide
        $exfil3 = "certutil" ascii wide nocase
        $exfil4 = "bitsadmin" ascii wide nocase

        // Cleo context
        $cleo1 = "Cleo" ascii wide nocase
        $cleo2 = "Harmony" ascii wide nocase
        $cleo3 = "VLTrader" ascii wide nocase

    condition:
        (any of ($cl0p*) and any of ($ransom*)) or
        (any of ($cleo*) and any of ($exfil*))
}

rule CVE_2024_50623_Network_IOC {
    meta:
        description = "Network indicators for CVE-2024-50623 exploitation"
        author = "Security Research"
        date = "2024-12-10"
        cve = "CVE-2024-50623"
        severity = "high"

    strings:
        // HTTP patterns
        $http1 = "PUT /Synchronize HTTP" ascii wide
        $http2 = "POST /Synchronize HTTP" ascii wide
        $http3 = "PUT /autorun/" ascii wide

        // Content-Type for uploads
        $ct1 = "Content-Type: application/xml" ascii wide nocase
        $ct2 = "Content-Type: text/xml" ascii wide nocase
        $ct3 = "Content-Type: application/octet-stream" ascii wide nocase

        // Response patterns indicating success
        $resp1 = "200 OK" ascii wide
        $resp2 = "201 Created" ascii wide

    condition:
        any of ($http*) and any of ($ct*)
}

:material-file-download: prevention/yara.yar

# CVE-2024-50623 - Cleo File Transfer Prevention Rules for Nginx

# Block access to vulnerable Cleo endpoints
location /Synchronize {
    # Block all access to file synchronization endpoint
    access_log /var/log/nginx/cve-2024-50623-attempts.log;
    return 403;
}

location /autorun/ {
    # Block autorun directory access
    return 403;
}

# Block file upload attempts with dangerous extensions
location ~* \.(jsp|jspx|war|jar|exe|bat|cmd|ps1|sh|xml)$ {
    # Only allow from trusted sources
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;

    # Log blocked attempts
    access_log /var/log/nginx/blocked-uploads.log;
}

# Block PUT method to prevent file uploads
location / {
    # Limit allowed methods
    limit_except GET POST {
        deny all;
    }

    # Block Cleo-specific attack patterns
    if ($request_uri ~* "(Synchronize|autorun|healthcheck)") {
        return 403;
    }

    # Block suspicious content types
    if ($content_type ~* "(application/java|text/xml|application/xml)") {
        set $suspicious "1";
    }
    if ($request_method = "PUT") {
        set $suspicious "${suspicious}1";
    }
    if ($suspicious = "11") {
        return 403;
    }
}

# Rate limiting for file operations
limit_req_zone $binary_remote_addr zone=cleo_upload:10m rate=5r/m;

location ~* ^/upload {
    limit_req zone=cleo_upload burst=2 nodelay;

    # Size limits
    client_max_body_size 50M;

    # Strict content type checking
    if ($content_type !~* "^(multipart/form-data|application/octet-stream)") {
        return 415;
    }
}

# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;

:material-file-download: prevention/nginx.conf

# CVE-2024-50623 - Cleo File Transfer Prevention Rules for Apache HTTPD

# Enable required modules
# LoadModule rewrite_module modules/mod_rewrite.so
# LoadModule security2_module modules/mod_security2.so

# Block vulnerable Cleo endpoints
<LocationMatch "^/(Synchronize|autorun)">
    Require all denied
    CustomLog /var/log/httpd/cve-2024-50623-blocked.log combined
</LocationMatch>

# Block dangerous file uploads
<FilesMatch "\.(jsp|jspx|war|jar|exe|bat|cmd|ps1|sh)$">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
</FilesMatch>

# ModSecurity Rules for CVE-2024-50623
<IfModule mod_security2.c>
    # Block Synchronize endpoint exploitation
    SecRule REQUEST_URI "@contains /Synchronize" \
        "id:2024506231,phase:1,deny,status:403,\
        msg:'CVE-2024-50623 Cleo Synchronize Endpoint Access',\
        logdata:'%{REQUEST_URI}',severity:CRITICAL"

    # Block autorun directory access
    SecRule REQUEST_URI "@rx /autorun/" \
        "id:2024506232,phase:1,deny,status:403,\
        msg:'CVE-2024-50623 Cleo Autorun Directory Access',\
        severity:CRITICAL"

    # Block JSP/WAR file uploads
    SecRule FILES_NAMES "@rx \.(jsp|jspx|war|jar)$" \
        "id:2024506233,phase:2,deny,status:403,\
        msg:'CVE-2024-50623 Dangerous File Upload Attempt',\
        severity:CRITICAL"

    # Block XML files with suspicious content
    SecRule REQUEST_BODY "@rx <\?xml.*<(command|execute|shell)" \
        "id:2024506234,phase:2,deny,status:403,\
        msg:'CVE-2024-50623 Malicious XML Upload',\
        severity:CRITICAL"

    # Block healthcheck manipulation
    SecRule REQUEST_URI "@contains healthcheck" \
        "id:2024506235,phase:1,chain,deny,status:403,\
        msg:'CVE-2024-50623 Healthcheck Manipulation'"
        SecRule REQUEST_METHOD "@streq PUT" ""

    # Detect Cl0p ransomware patterns
    SecRule REQUEST_BODY "@rx (powershell|certutil|bitsadmin)" \
        "id:2024506236,phase:2,deny,status:403,\
        msg:'CVE-2024-50623 Potential Ransomware Payload',\
        severity:CRITICAL"
</IfModule>

# Limit PUT method
<Limit PUT DELETE>
    Require all denied
</Limit>

# File upload size limits
LimitRequestBody 52428800

# Logging
CustomLog /var/log/httpd/cleo-access.log combined

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2024-50623?

CVE-2024-50623 (Cleo) is a Critical (9.8) vulnerability: Cleo File Transfer RCE. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-13), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2024-50623?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-50623?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-50623 actively exploited?

Yes. CVE-2024-50623 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-12-13, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2025-01-03. Prioritise patching and deploy the detection and prevention rules above.

---

For authorized security testing and research only. See the full source and NVD record.