CVE-2024-57728: SimpleHelp Path Traversal (Zip Slip) -- Arbitrary File Write via Admin Upload

Background

SimpleHelp is a self-hosted remote support and remote access platform widely used by managed service providers (MSPs), IT departments, and support organisations. It provides technician-to-device connectivity for remote troubleshooting, file transfers, and unattended access. Because SimpleHelp deployments often hold access credentials to hundreds or thousands of managed customer endpoints, they are prime targets in supply-chain-style attacks — compromising the MSP’s SimpleHelp server yields access to all managed customers.

CVE-2024-57728 was added to the CISA KEV catalogue on 2026-04-24 alongside CVE-2024-57726 (missing authorisation). The two vulnerabilities chain cleanly: CVE-2024-57726 escalates a low-privilege technician to admin, then CVE-2024-57728 uses that admin access to write arbitrary files via malicious archive upload. Ransomware exploitation of this chain has been confirmed.

Technical Mechanism

CVE-2024-57728 is a classic “zip slip” vulnerability — a form of path traversal that manifests in archive extraction logic. When a web application extracts a ZIP or TAR archive without sanitising the paths of entries within the archive, an attacker can craft an archive containing entries with ../ sequences in their filenames, causing files to be written outside the intended extraction directory.

The attack flow in SimpleHelp is as follows:

1. An attacker with admin privileges (potentially acquired via CVE-2024-57726) accesses the SimpleHelp administrative interface
2. The attacker crafts a malicious ZIP archive containing a file entry with a path-traversal filename, such as ../../../../etc/cron.d/backdoor or a SimpleHelp plugin file in an unexpected location
3. The archive is uploaded through the legitimate file upload functionality (e.g., plugin installation, custom branding, or configuration import)
4. SimpleHelp’s extraction routine iterates archive entries and writes each file to its specified path without stripping or validating ../ sequences
5. The malicious file is written to an attacker-controlled location outside the intended directory
6. Depending on the target path and content, the attacker achieves code execution (e.g., a cron job that runs a reverse shell, a malicious JAR dropped into an auto-load directory, or overwriting a configuration file)

The vulnerability allows writing files with the permissions of the SimpleHelp process, which typically runs as a high-privileged service account or root.

Real-World Exploitation Evidence

CVE-2024-57728 was added to CISA KEV on 2026-04-24 with Known Ransomware exploitation confirmed. Intelligence reporting indicates:

• Ransomware groups have targeted SimpleHelp servers held by MSPs, using the zip slip vulnerability (in conjunction with the privilege escalation in CVE-2024-57726) to establish persistent access to MSP infrastructure
• The MSP attack pattern is well-documented: compromising the MSP’s remote support tooling grants immediate access to all managed customers, multiplying the impact of a single exploitation event
• The combination with CVE-2024-57726 (missing authorisation for API key creation) creates a two-step attack chain: escalate to admin, then use zip slip to write a persistence mechanism

Security researchers noted that proof-of-concept exploit code demonstrating the zip slip behaviour was publicly available, lowering the bar for exploitation.

Impact Assessment

CVE-2024-57728 directly affects the SimpleHelp server itself. An attacker with admin access — whether legitimately or via CVE-2024-57726 — can write arbitrary files anywhere on the server filesystem with the permissions of the SimpleHelp process, which typically runs as a privileged service account or root. The practical outcome is arbitrary code execution: writing a cron job, a malicious JAR in an auto-load directory, or an SSH authorised key achieves persistence and OS-level control of the server. The 9.1 CVSS score reflects that admin credentials are a prerequisite, but those credentials are readily obtained by chaining with CVE-2024-57726.

From a business impact perspective, the consequences mirror those of the privilege escalation vulnerability but are more severe and durable: file-based persistence installed via zip slip survives patching of both CVEs unless the filesystem is audited and cleaned. MSPs running SimpleHelp face the greatest exposure — a compromised server with persistent backdoors allows an attacker to maintain access to all managed customer endpoints indefinitely. For downstream customers of affected MSPs, this represents an invisible supply chain breach, and initial compromise indicators may not be visible until the attacker activates their access for ransomware deployment or data theft.

Affected Versions

Consult the SimpleHelp security advisory for precise version numbers. SimpleHelp releases are typically identified by version number on the vendor’s download portal.

Remediation Steps

1. Update SimpleHelp to the latest patched version immediately
2. If immediate patching is not possible, disable file upload functionality in the SimpleHelp admin interface via configuration or firewall ACLs
3. Restrict admin interface access to trusted IP addresses only
4. Audit the SimpleHelp server filesystem for unexpected files in locations outside the normal application directory, paying particular attention to:
   • Cron directories (/etc/cron.*, /var/spool/cron/)
   • Web application directories that may auto-load code
   • SSH authorised keys files
5. Review SimpleHelp admin audit logs for unexpected file upload activity
6. Rotate all API keys and service account credentials associated with the SimpleHelp deployment
7. Review CVE-2024-57726 remediation in parallel — the two vulnerabilities are often exploited together
8. If running as an MSP, notify affected customers and assess whether downstream access was used

Detection Guidance

SimpleHelp logs — review admin activity logs for file upload events, particularly:

• ZIP/archive uploads to plugin or configuration endpoints
• Uploads from unexpected administrator accounts or IP addresses

Filesystem monitoring:

• Deploy file integrity monitoring (FIM) on the SimpleHelp server
• Alert on file creation events outside the SimpleHelp application directory
• Monitor cron directories and SSH configuration files for unexpected modifications

SIEM query example (Splunk):

index=simplehelp_logs action="file_upload"
| eval suspicious=if(match(filename, "\.\./"), "YES", "NO")
| where suspicious="YES"
| stats count by src_ip, user, filename

OS-level indicators:

• New or modified files in /etc/cron.* or user crontabs
• Modified SSH authorized_keys files
• New JAR files or class files in application directories

Timeline

References

• NVD — CVE-2024-57728
• CISA KEV — CVE-2024-57728
• MITRE CVE — CVE-2024-57728