CVE-2024-57728
Published: 15 January 2025
Summary
CVE-2024-57728 is a high-severity Link Following (CWE-59) vulnerability in Simple-Help Simplehelp. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked in the top 1.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the zip slip vulnerability in SimpleHelp, preventing exploitation through timely flaw remediation.
Mandates validation of zip file inputs to block path traversal payloads that enable arbitrary file writes outside intended directories.
Enforces least privilege for the SimpleHelp server process, limiting the impact of arbitrary code execution even if file overwrites succeed.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The zip slip vulnerability enables authenticated admins to upload crafted ZIP files for arbitrary file writes anywhere on the filesystem, leading to RCE in the server context. This facilitates exploitation of public-facing applications/remote services (T1190/T1210), abuse of server software components (T1505), web shell deployment (T1100), and malware upload (T1608.001).
NVD Description
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in…
more
the context of the SimpleHelp server user.
Deeper analysisAI
CVE-2024-57728 affects SimpleHelp remote support software versions 5.5.7 and earlier. The vulnerability is a zip slip flaw (CWE-59, CWE-22) that allows authenticated admin users to upload crafted zip files, enabling arbitrary file writes anywhere on the file system. This can lead to arbitrary code execution on the host in the context of the SimpleHelp server user. Published on 2025-01-15, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H).
An attacker with admin privileges can exploit this over the network with low complexity and no user interaction required. By uploading a malicious zip file, they achieve remote code execution as the server process user, potentially compromising the host through file overwrites in critical paths like executables or configuration files.
Advisories reference mitigations including a vendor knowledge base article on vulnerabilities in SimpleHelp 5.5.7 and earlier (simple-help.com), a Horizon3.ai disclosure on critical issues, and CISA's Known Exploited Vulnerabilities catalog entry.
The vulnerability is listed in CISA's KEV catalog, signaling real-world exploitation. References link it to ransomware activity, including Storm-1175 operations targeting web-facing assets in Medusa ransomware campaigns (Microsoft) and DragonForce ransomware (Trend Micro).
Details
- CWE(s)
- KEV Date Added
- 24 April 2026