Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
HighCISA KEVExploited in the wildPublic exploit

SimpleHelp Zip Slip Arbitrary File Upload Leading to RCE

IdentifiersCVE-2024-57728CWE-22· Improper Limitation of a Pathname…

CVE-2024-57728 affects SimpleHelp remote support software version 5.5.7 and earlier. It is a path traversal/arbitrary file upload issue in the ZIP upload handling logic, commonly described as a Zip Slip vulnerability. An authenticated administrator can upload a crafted ZIP archive whose entries traverse outside the intended extraction directory, allowing arbitrary files to be written anywhere on the underlying host filesystem. Because the write primitive reaches arbitrary paths on the server, an attacker can place malicious files in locations that will be executed or loaded by the operating system or applications. Reported examples include planting cron jobs on Linux or overwriting executables or libraries on Windows, resulting in arbitrary code execution in the security context of the SimpleHelp server user.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to full compromise of the SimpleHelp server host in the context of the SimpleHelp server user. The attacker can overwrite or create files outside the application directory, execute arbitrary code, establish persistence, deploy reverse shells or malware, and use the compromised RMM server as a pivot into downstream managed environments. In observed and reported attack chains, this vulnerability has been used alongside CVE-2024-57726 and CVE-2024-57727 and has been associated with ransomware activity, including DragonForce/Medusa-related intrusions.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict access to the SimpleHelp administrative interface to trusted IP ranges, enforce MFA for all administrator and technician accounts, monitor for suspicious ZIP uploads and unexpected file creation on the host, and review logs for anomalous API key creation or administrative actions. Limit exposure of the SimpleHelp server to the internet where possible. If mitigations cannot be implemented, CISA guidance in the provided content indicates organizations should discontinue use or disconnect the product from the network until it can be secured.

Remediation

Patch, then assume compromise.

Upgrade SimpleHelp to a fixed release. The provided content states SimpleHelp released patches and advised customers to update to 5.5.8, 5.4.10, or 5.3.9, depending on branch. Apply vendor instructions for all affected SimpleHelp servers, then rotate administrator and technician passwords and review for unauthorized API keys or suspicious uploaded files. Because this vulnerability may be chained with privilege escalation and path traversal flaws, remediation should address the full SimpleHelp vulnerability set rather than CVE-2024-57728 in isolation.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
SimpleHelpSimplehelpapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence10

Every observed campaign linking this CVE to a named adversary.

Associated malware14

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity15

Community discussion across Reddit, Mastodon, and other social sources.