- Security researchers Huntress uncover flaw in LexiCom, VLTransfer, and Harmony tools
- The flaw was patched more than a month ago, but the patch did not work
- Now hackers are abusing the bug, possibly to steal data
Multiple managed file transfer tools from the same developer are being abused to launch attacks and possibly steal data, experts have warned, with dozens of organizations already targeted.
Cybersecurity researchers at Huntress have claimed LexiCom, VLTransfer, and Harmony were all vulnerable to CVE-2024-50623, an unrestricted file upload and download vulnerability that could lead to remote code execution.
All three tools were built by the same company, Cleo, which published a patch for the bug in late October 2024 – however, Huntress claims that the patch doesn’t work well and doesn’t protect the users from threat actors.
Post-exploitation activity
In fact, Huntress, which says its tools protect more than 1,700 Cleo users, claims it spotted at least 24 compromised businesses.
“Victim organizations so far have included various consumer product companies, logistics and shipping organizations, and food suppliers,” Huntress said in its writeup, adding that countless other companies are at risk.
TechCrunch added that Shodan shows “hundreds” of vulnerable Cleo servers, mostly in the United States. The company has more than 4,000 clients, including a number of large enterprises.
The attackers have not yet been identified, and Huntress is not conclusively saying if they stole any information from these organizations. However, the researchers did say that the threat actors were running “post-exploitation” activity, which could hint that files were, indeed, stolen.
Cleo acknowledged the flaw, and confirmed the team was working on a further fix, but until that is released, users should put the tools behind a firewall, just to be on the safe side.
Managed file transfer (MFT) solutions and security issues started grabbing headlines in 2023, when a Russian ransomware group Cl0p found a hole in MOVEit and used it to exfiltrate data from thousands of organizations around the world.
Via TechCrunch