# CVE-2024-57727: SimpleHelp Path Traversal Vulnerability

- Exploited (CISA KEV): yes, added 2025-02-13, known ransomware use
- Published: 2025-01-15
- CVSS: 9.1 CRITICAL (v3.1)
- EPSS: 96.8% (100th percentile)
- CWE: CWE-22

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-02-18 | 34 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-02-18 · new · rule 498fcd81a62a4b5ca943e2de958094d3 · default Block
  > SimpleHelp - Auth Bypass - CVE:CVE-2024-57727. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-02-18-waf-release/
- 2025-09-29 · updated · rule 6fe90532af50427484a5275c8c2e30fb · default Block
  > SimpleHelp - Auth Bypass - CVE:CVE-2024-57727. Previous action: Log. New action: Block. This rule is merged to 100717 in legacy WAF and ...958094d3 in new WAF
  Source: https://developers.cloudflare.com/changelog/post/2025-09-29-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-57727, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-57727, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-57727 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-57727