Description
Cleo LexiCom等都是Cleo公司的产品。Cleo LexiCom是一个集成平台。Cleo Harmony是一个文件集成解决方案。Cleo VLTrader是一个安全托管文件传输软件。 Cleo多款产品存在安全漏洞，该漏洞源于包含一个JavaScript注入问题。以下产品及版本受到影响：Cleo Harmony 5.8.0.20版本之前，VLTrader 5.8.0.20版本之前和LexiCom 5.8.0.20版本。
Cleo多款产品 /Synchronization 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2024-50623
https://blog.csdn.net/jd_cx/article/details/148151662
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/Cleo%20Harmony/Cleo%20Harmony%E6%8E%A5%E5%8F%A3Synchronization%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://ddpoc.com/DVB-2024-8621.html
https://cn-sec.com/archives/3993034.html
https://www.tenablecloud.cn/plugins/was/114544
https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory-CVE-2024-50623
https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/
https://www.darktrace.com/blog/cleo-file-transfer-vulnerability-patch-pitfalls-and-darktraces-detection-of-post-exploitation-activities
https://nvd.nist.gov/vuln/detail/CVE-2024-50623
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild