CVE-2024-57728: SimpleHelp Path Traversal Vulnerability
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Overview
SimpleHelp remote support software versions before 5.5.8 contain a zip slip path traversal flaw in its file upload functionality. An authenticated administrator can upload a crafted zip archive containing directory-traversal sequences in its entry names, causing the server to write files to arbitrary locations on the host filesystem. Successful exploitation results in remote code execution under the SimpleHelp server process account. This vulnerability is actively used in ransomware operations, including campaigns attributed to Medusa ransomware.
Vulnerability details
The flaw stems from insufficient sanitization of file paths embedded within uploaded zip archives, a class of weakness known as zip slip. When the SimpleHelp server extracts an uploaded archive, it does not strip or reject path components such as sequences that traverse parent directories. An attacker who controls the zip file's entry names can therefore direct extracted content to any location the server process can write to, bypassing the intended upload directory boundary entirely. This is a classic CWE-22 path traversal condition compounded by improper file-link resolution during extraction.
An attacker must first authenticate to the SimpleHelp admin interface, either as the built-in SimpleHelpAdmin account or as a technician account holding administrator privileges. Once authenticated, they upload a crafted zip file through the admin interface. On Linux hosts, a planted crontab entry provides command execution; on Windows hosts, overwriting an executable or library loaded by SimpleHelp achieves the same result. The mechanism notes that admin access may itself be obtained by chaining with other vulnerabilities in the same release line, and Microsoft has documented Storm-1175 chaining these SimpleHelp flaws in Medusa ransomware intrusions.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review SimpleHelp server logs for file upload activity originating from admin sessions, particularly any upload events followed shortly by new process execution or crontab modification on Linux hosts, which would indicate successful zip slip exploitation.
- On Linux, monitor for unexpected modifications to cron directories or crontab files owned by the SimpleHelp server process user. On Windows, watch for replacement of files within the SimpleHelp installation path, especially JAR files or executables, outside of a known patching window.
Remediation
Additional hardening
- Upgrade SimpleHelp to version 5.5.8 or later; users on the 5.4 or 5.3 release lines should apply the vendor-supplied patches for those branches, with details in the vendor advisory listed in References.
- Restrict the IP addresses permitted to authenticate to the SimpleHelp admin and technician interfaces using the server's built-in login restriction controls, reducing the pool of sources that could submit a malicious upload.
- Rotate the SimpleHelpAdmin password and all local technician account passwords immediately, as the vendor advisory notes that configuration files containing password hashes may have been exposed via related vulnerabilities in the same release.
- Place the SimpleHelp server behind a network boundary that limits direct internet exposure of the admin interface, and apply host-based file integrity monitoring on the SimpleHelp installation directory and system cron paths to detect unauthorized file writes.
Key dates
References
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
- https://nvd.nist.gov/vuln/detail/CVE-2024-57728
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57728
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce
Frequently asked questions
Does CVE-2024-57728 affect my FedRAMP authorization?
If SimpleHelp runs inside your authorization boundary, yes. CVE-2024-57728 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 8, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. At this point, your path is to remediate now or formally document the mitigation and the delay.
How does Knox help me handle CVE-2024-57728?
Knox does not patch SimpleHelp on your behalf. Under the FedRAMP shared-responsibility model, remediating CVE-2024-57728 is your obligation. What Knox provides is the pre-authorized, single-tenant boundary in which that remediation takes place, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours; managing your compliance posture while you do it is not something you handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a case like CVE-2024-57728, that means exposure surfaces during continuous monitoring rather than waiting for an assessor to flag it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2024-57728's remediation deadline of May 8, 2026 has passed. What happens now?
If CVE-2024-57728 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
