# Cleo Software Actively Being Exploited in the Wild

Cleo Harmony/VLTrader/LexiCom arbitrary file-write lets unauthenticated attackers drop autorun files that execute PowerShell, and the 5.8.0.21 patch fails to stop it.

- Payout: Real-world hack
- Severity: critical
- Program: Cleo
- Analysis by: Huntress
- Disclosed: 2025-01-06
- CVE: CVE-2024-55956
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
- Tags: area:cloud domain:infra impact:internal-access impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:chained technique:incomplete-fix vuln:file-upload vuln:rce

**Target:** Cleo Harmony/VLTrader/LexiCom managed file transfer servers (autorun directory)
**Root cause:** An arbitrary file-write primitive lets unauthenticated attackers place files in the autorun subdirectory; Cleo software immediately reads, interprets and evaluates autorun files, so a crafted autorun invokes native Import of a ZIP whose main.xml stages a PowerShell command. The CVE-2024-50623 patch does not remove the file-write primitive, so 5.8.0.21 remains exploitable.
**Steps:**
1. Identify internet-exposed Cleo Harmony/VLTrader/LexiCom (default install paths `C:\LexiCom`, `C:\VLTrader`, `C:\Harmony`).
2. Use the arbitrary file-write primitive to drop `autorun\healthchecktemplate.txt` (or `healthcheck.txt`) into the autorun directory.
3. The autorun invokes native Import, loading a second dropped file `temp\LexiCom6836057879780436035.tmp` — actually a ZIP containing `hosts` subdirectory with an inner `main.xml`.
4. main.xml stages a new autorun (`healthcheck.txt`) whose action invokes an encoded PowerShell command.
5. PowerShell reaches out to an attacker IP to retrieve JAR files with webshell-like persistence; JARs are deleted post-execution.
6. Post-exploitation: enumerate AD with `nltest.exe`.
**How found:** Huntress observed in-the-wild exploitation logs showing `autorun\healthchecktemplate.txt` as the first artifact; knowing autorun files are immediately evaluated, they reconstructed the chain and built a Python PoC to confirm the file-write primitive still works on patched 5.8.0.21.
**Exploitation:** Unauthenticated attacker writes autorun files via the file-write flaw; Cleo auto-processes them, Import loads a ZIP-staged main.xml that triggers encoded PowerShell, which pulls remote JARs for webshell persistence, then deletes them and runs AD recon (nltest.exe). Observed against at least 10 businesses in consumer products, food, trucking and shipping.
**Escalation:** File-write primitive chained through autorun evaluation and native Import to achieve remote code execution and persistent webshells, then lateral AD reconnaissance.
**Insight:** When a vendor patches an RCE, test whether the underlying primitive (here arbitrary file-write) survives and whether a legitimate auto-evaluated feature (autorun/Import) can convert it back to code execution — patched versions can remain exploitable.