SimpleHelp Remote Support Software Vulnerability Let Attackers Execute Remote Code

Researchers have disclosed three critical vulnerabilities in SimpleHelp, a widely used remote support software, that could allow attackers to compromise servers and client machines.

These flaws, identified as CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726, pose severe risks, including unauthorized file access, privilege escalation, and remote code execution.

SimpleHelp has released patches to address these issues and urges users to update their systems immediately to versions 5.5.8, 5.4.10, or 5.3.9.

SimpleHelp Remote Support Software Vulnerabilities

CVE-2024-57727: Unauthenticated Path Traversal

• This vulnerability allows unauthenticated attackers to download arbitrary files from the SimpleHelp server. Sensitive data such as hashed administrator passwords, LDAP credentials, API keys, and multi-factor authentication (MFA) seeds are stored in the serverconfig.xml file can be accessed.
• The flaw is particularly critical because encrypted configuration files use hardcoded keys, making it easier for attackers to decrypt sensitive information.

CVE-2024-57728: Arbitrary File Upload Leading to Remote Code Execution

• Attackers with admin privileges—or those who exploit privilege escalation (see CVE-2024-57726)—can upload files to any location on the server host. For example:
  • On Linux servers, malicious cron jobs can execute remote commands.
  • On Windows servers, executables or libraries can be overwritten to achieve remote code execution.
• An attacker could use this vulnerability to deploy a reverse shell or other malicious payloads.

CVE-2024-57726: Privilege Escalation

• Due to missing backend authorization checks in certain administrative functions, low-privilege technician accounts can escalate their privileges to admin status by crafting specific network calls.
• Once escalated, attackers can exploit CVE-2024-57728 to fully compromise the SimpleHelp server.

Potential Impact

If exploited, these vulnerabilities could allow attackers to:

• Take control of SimpleHelp servers.
• Access sensitive customer data stored on the server.
• Compromise client machines connected via SimpleHelp’s remote access features.
• Deploy ransomware or other malware across networks using compromised SimpleHelp installations.

The vulnerabilities are described as “trivial to reverse and exploit,” raising concerns about potential abuse by cybercriminals or nation-state actors.

SimpleHelp versions prior to 5.5.8, 5.4.10, or 5.3.9 are vulnerable. The version of a SimpleHelp server can be determined by accessing its /allversions endpoint or inspecting the HTTP Server header.

SimpleHelp released patches to address the vulnerabilities; organizations are recommended to apply patches soon.

To mitigate these risks:

1. Update Immediately: Upgrade to versions 5.5.8 (or equivalent patches for older branches).
2. Change Credentials: Rotate administrator and technician account passwords.
3. Restrict Access: Limit IP addresses allowed to access the SimpleHelp server’s admin interface.
4. Enable MFA: Ensure multi-factor authentication is enabled for all accounts.

Horizon3.ai researchers discovered the vulnerabilities and disclosed them responsibly to SimpleHelp on January 6, 2025. Patches were released within a week—on January 8 for versions 5.3.x and 5.4.x and on January 13 for version 5.5.x—demonstrating a swift response from the vendor.

Threat actors frequently target remote support tools like SimpleHelp due to their ability to provide persistent access across networks. In the past, similar tools have been abused by groups like Iran’s MuddyWater for espionage campaigns and ransomware operators for lateral movement within compromised environments.

While there is no evidence yet of active exploitation of these vulnerabilities in the wild, history suggests that unpatched systems are likely targets for cybercriminals once technical details become public.

The disclosure of these critical vulnerabilities underscores the importance of maintaining up-to-date software in environments where remote access tools are used extensively. Organizations relying on SimpleHelp must act immediately to patch their systems and implement additional security measures to mitigate potential exploitation risks.

Failure to address these vulnerabilities could lead to severe consequences, including data breaches, operational disruptions, and financial losses due to ransomware attacks or regulatory penalties for non-compliance with cybersecurity standards.

The year 2024 highlighted significant risks associated with remote support and access software, as it was marked by the exploitation of critical zero-day vulnerabilities in two widely used platforms: ConnectWise ScreenConnect and BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS).

These vulnerabilities—CVE-2024-1708, CVE-2024-1709, CVE-2024-12356, and CVE-2024-12686—were actively exploited in the wild and subsequently added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog due to their severe impact.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free