CVE-2021-33576: 
Cleo LexiCom vulnerability analysis and mitigation

An issue was discovered in Cleo LexiCom 5.5.0.0 on June 18, 2021. Within the AS2 message, the sender can specify a filename that can include path-traversal characters, allowing the file to be written to an arbitrary location on disk (NVD, Atredis).

The vulnerability stems from two key flaws in Cleo LexiCom's implementation: First, the requirement for AS2 message senders to identify themselves via encryption and signing can be bypassed by changing the Content-Type to text/plain. Second, the filename specification in AS2 messages can include path-traversal characters, enabling arbitrary file writing on disk. The vulnerability has been assigned a CVSS score of 7.5 (CISA, Atredis).

This vulnerability can be exploited to gain remote command execution on the system. An attacker can take advantage of the application's autorun feature by writing files to C:\LexiCom\autorun directory, which LexiCom will then parse and attempt to execute as scripts (Atredis).

It is unknown if versions after 5.5.0.0 address this issue. A partial mitigation may be possible by requiring in-bound messages to be signed and encrypted, which must be configured on a partner-by-partner basis. However, this would not prevent a trading partner from exploiting the vulnerability to gain code execution (Atredis).