WARNING: CRITICAL VULNERABILITIES IN SIMPLEHELP REMOTE ACCESS SOFTWARE CAN LEAD TO INFO DISCLOSURE, PRIVILEGE ESCALATION, AND REMOTE CODE EXECUTION, PATCH IMMEDIATELY!

Reference:
Advisory #2025-014

Version:
1.0

Affected software:
SimpleHelp = 5.5.7

Type:
Path traversal, arbitrary file inclusion, privilege escalation

CVE/CVSS:

Sources

https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier

Risks

Update (2025-01-29) According to various sources, the vulnerabilities are actively exploited by threat actors.

• CVE-2024-57727 - This vulnerability allows unauthenticated attackers to download arbitrary files from the SimpleHelp server. Notably, sensitive files such as the serverconfig.xml file, which contains hashed passwords for administrative accounts, can be accessed, potentially exposing other secrets like LDAP credentials and API keys.
• CVE-2024-57728 - An attacker with admin privileges (either as SimpleHelpAdmin or a technician with admin rights) can exploit this vulnerability to upload arbitrary files to any location on the host. This can lead to remote code execution, such as uploading a malicious crontab on Linux servers or replacing executables on Windows servers to execute arbitrary code.
• CVE-2024-57726 - This vulnerability allows a low-privilege technician to escalate their privileges to admin due to missing authorization checks in SimpleHelp's backend. By crafting a specific sequence of network requests, an attacker can gain admin access and exploit other vulnerabilities, such as arbitrary file upload, to take control of the system.

Description

1. Exploiting CVE-2024-57727 (Unauthenticated path traversal) to download sensitive files, such as the serverconfig.xml file, which contains hashed passwords for administrative accounts.
2. Using the credentials obtained from the configuration file to log in as a technician or administrator.
3. Exploiting CVE-2024-57728 (Arbitrary file upload) to upload malicious files, such as a reverse shell or a crontab file, to gain remote code execution on the server.
4. If the attacker initially has low-level technician access, they can use CVE-2024-57726 (Privilege escalation) to elevate their privileges to admin.
5. With admin access, the attacker can now fully control the SimpleHelp server, access connected customer machines, and maintain persistent access.

Recommended Actions

References

https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/