CVE-2021-33576
📋 TL;DR
CVE-2021-33576 is a path traversal vulnerability in Cleo LexiCom AS2 file transfer software. Attackers can manipulate filenames in AS2 messages to write files to arbitrary locations on the server's filesystem. Organizations using Cleo LexiCom 5.5.0.0 for AS2 file transfers are affected.
💻 Affected Systems
- Cleo LexiCom
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via writing malicious files to critical system locations, complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file writes to sensitive directories, potential data corruption, or denial of service by overwriting critical files.
If Mitigated
Limited impact if proper file system permissions restrict write access to non-critical directories only.
🎯 Exploit Status
Exploitation requires sending a specially crafted AS2 message with path traversal characters in filename field. Public proof-of-concept available in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.0.1 or later
Vendor Advisory: https://www.cleo.com/cleo-lexicom
Restart Required: Yes
Instructions:
1. Download latest Cleo LexiCom version from vendor portal. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart LexiCom services. 5. Verify AS2 functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom validation to reject AS2 messages containing path traversal sequences in filenames
Custom implementation required - no standard commands
Restrict File System Permissions
allConfigure LexiCom service account with minimal write permissions to specific directories only
chmod 755 /var/lexicom/files (Linux)
icacls C:\LexiCom\Files /grant Users:RX (Windows)
🧯 If You Can't Patch
- Implement network segmentation to isolate LexiCom servers from critical systems
- Deploy web application firewall (WAF) with path traversal detection rules for AS2 traffic
🔍 How to Verify
Check if Vulnerable:
Check LexiCom version via admin interface or configuration files. Version 5.5.0.0 is vulnerable.Check Version:
Check LexiCom admin console or configuration file version settingVerify Fix Applied:
Verify version is 5.5.0.1 or later. Test AS2 file upload with path traversal attempts should be rejected.📡 Detection & Monitoring
Log Indicators:
- AS2 messages with filenames containing ../ or ..\ patterns
- File write errors to unexpected directories
- Unauthorized file creation in system directories
Network Indicators:
- AS2 traffic with unusual filename patterns
- Multiple failed file write attempts
SIEM Query:
source="lexicom" AND (filename="*../*" OR filename="*..\*")