CVE-2023-6110: Rogue Account Creation in SimpleHelp — Patch Now

A significant vulnerability has been disclosed in the SimpleHelp remote management and support software that allows unauthenticated actors to create rogue technician accounts. According to BleepingComputer, this flaw bypasses intended security controls, granting attackers high-level access to the management console and, by extension, the endpoints managed by the software. This CVE is identified as CVE-2023-6110.

Technical Analysis of the SimpleHelp OIDC Flaw

The vulnerability stems from a logical error in how the SimpleHelp server handles OpenID Connect (OIDC) authentication flows. In a standard secure configuration, an administrator might expect that disabling public account registration would prevent unauthorized users from joining the platform. However, the OIDC implementation failed to enforce these restrictions consistently. An attacker can initiate a registration request through the OIDC provider that the SimpleHelp server incorrectly validates, leading to the creation of a new, fully functional technician account.

Because technician accounts are often granted broad permissions by default, this vulnerability effectively facilitates Privilege Escalation. Once the rogue account is active, the attacker can leverage the platform’s legitimate features to deploy scripts, access remote files, or establish remote desktop sessions on any client machine connected to the SimpleHelp instance. This type of access is highly sought after by threat actors because it provides a legitimate path for Lateral Movement and remote execution without the need for additional malware on the target endpoints.

SimpleHelp 5.2.23 Patch Guidance and Detection

For organizations currently running older builds, following the SimpleHelp 5.2.23 patch guidance is the primary method of defense. The vendor has released version 5.2.24, which specifically addresses this OIDC bypass. Beyond simply updating, security teams must understand how to detect CVE-2023-6110 exploit attempts that may have occurred prior to the discovery.

Defenders should prioritize auditing their technician logs and account lists. Because the exploit results in the creation of a new user entity, any unfamiliar account in the ‘Technicians’ group should be treated as a high-severity IoC. Security personnel operating a SOC should review server logs for unusual POST requests directed at OIDC-related endpoints, particularly those originating from unexpected IP addresses or occurring outside of established maintenance windows.

Mitigation and Long-Term Recommendations

The immediate remediation is to upgrade to SimpleHelp version 5.2.24. This version introduces stricter validation for OIDC claims and enforces registration policies correctly. If an immediate upgrade is not possible, administrators should consider disabling OIDC authentication temporarily and reverting to local authentication or LDAP, provided those paths are secured with multi-factor authentication.

Furthermore, practitioners should adopt a Zero Trust approach to remote management tools. Access to the SimpleHelp administrative interface should be restricted to known management IP ranges or protected behind a VPN. Regularly reviewing the audit logs generated by SimpleHelp for any unauthorized remote session activity is necessary to ensure that even if an account is compromised, the impact is detected rapidly. Integrating SimpleHelp logs into a SIEM can provide the visibility needed to correlate remote support activity with other network events, reducing the dwell time of potential attackers.