CVE-2024-57728 : SimpleHelp Arbitrary File Upload

Executive Summary

SimpleHelp remote support software versions 5.5.7 and earlier are vulnerable to a path traversal flaw, identified as CVE-2024-57728, which facilitates arbitrary file uploads. This vulnerability, categorized as a Zip Slip, permits authenticated administrative users to upload files to arbitrary locations on the host file system. Successful exploitation leads to remote code execution (RCE) within the context of the SimpleHelp server process, posing a severe risk to infrastructure integrity.

Vulnerability Details

The root cause of the vulnerability lies in improper input validation during the file upload process. Specifically, the application fails to adequately sanitize zip file entry paths. By crafting a malicious archive containing path traversal sequences, such as ../../, an attacker can bypass intended directory restrictions.

When processed by the SimpleHelp server, these sequences allow the file to be extracted outside of the designated storage directory. If the server application is running on Linux, an attacker can target critical system files, such as crontab, to trigger automated command execution. On Windows-based systems, overwriting application executables or system libraries can similarly achieve full code execution.

Impact Analysis

The potential for exploitation is significant. As an administrative capability, this vulnerability enables an attacker to:

Establish persistent access to the SimpleHelp host.
Gain full control over the server and potentially managed client endpoints.
Facilitate lateral movement across the network by utilizing the compromised server as a pivot point.

Given that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, immediate remediation is essential.

Forensic Indicators

Security teams should monitor for the following markers of compromise:

Unauthorized Access Attempts: The presence of [WebDownloadServer] Insecure request... in SimpleHelp server logs is a primary indicator of external actors attempting to access unauthorized resources.
System File Modifications: Unexpected creation or modification of crontab files, system binaries, or application libraries within the SimpleHelp installation directory or system paths.
Anomalous Process Spawning: The SimpleHelp Java process initiating unexpected child processes such as sh, cmd.exe, or powershell.

Mitigation and Detection

Immediate upgrade to the latest version of SimpleHelp is the primary recommendation. If upgrading is not immediately feasible, ensure strict access control policies for administrative accounts.

Sigma Rule

title: Potential SimpleHelp CVE-2024-57728 Exploit Attempt
description: Detects unauthorized file access attempts targeting SimpleHelp server.
logsource:
  category: web_server
detection:
  selection:
    log_message|contains: "[WebDownloadServer] Insecure request"
  condition: selection