Full Report
This blog discusses the Huntress Team's analysis efforts of the two vulnerabilities and software weaknesses in ConnectWise ScreenConnect (CVE-2024-1708 and CVE-2024-1709) and the technical details behind this attack.
Analysis Summary
# Vulnerability: ConnectWise ScreenConnect "SlashAndGrab" Exploit
## CVE Details
- **CVE ID:** CVE-2024-1709 (Authentication Bypass), CVE-2024-1708 (Path Traversal)
- **CVSS Score:** 10.0 (Critical) for CVE-2024-1709; 8.4 (High) for CVE-2024-1708
- **CWE:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-22 (Path Traversal)
## Affected Systems
- **Products:** ConnectWise ScreenConnect (formerly ConnectWise Control)
- **Versions:** All versions 23.9.7 and prior.
- **Configurations:** Primarily impacts **on-premise** installations. Cloud-hosted instances were automatically patched by the vendor.
## Vulnerability Description
The primary flaw (CVE-2024-1709) allows a remote, unauthenticated attacker to bypass the application's security logic by accessing the setup wizard on an already-configured server. By appending a specific path (often referred to as the "SlashAndGrab" technique) to the URL, the application incorrectly permits access to the initial setup module.
Once in the setup wizard, an attacker can overwrite the administrative user database or create a new administrative user. This provides full control over the ScreenConnect instance, which can then be leveraged via CVE-2024-1708 (Path Traversal) to achieve Remote Code Execution (RCE) by uploading malicious scripts or binaries to restricted directories.
## Exploitation
- **Status:** **Exploited in the wild.** Proof-of-Concept (PoC) code is widely available and the exploit is considered "trivial" to execute.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Attacker can access all session data and remote endpoints)
- **Integrity:** Total (Attacker can modify application state and system files)
- **Availability:** Total (Attacker can lock out legitimate admins or crash the service)
## Remediation
### Patches
- **ScreenConnect Version 23.9.8:** This version contains the necessary fixes to prevent unauthorized access to the SetupWizard. On-premise users must update immediately.
### Workarounds
- There are no reliable software workarounds other than updating the software.
- Restrict network access to the ScreenConnect web interface to trusted IP addresses or via VPN until patching is complete.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of new, unauthorized administrative users in the ScreenConnect user management console.
- HTTP requests to `/SetupWizard.aspx/` (note the trailing slash) on existing installations.
- Modifications to `User.xml` or database files that occurred outside of scheduled maintenance.
- **Detection Methods:**
- Monitor web server logs for status code `200` responses to the `SetupWizard.aspx` path.
- Inspect endpoints for suspicious child processes spawning from `ScreenConnect.Service.exe`.
## References
- **Vendor Advisory:** hxxps://www[.]connectwise[.]com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- **Huntress Technical Analysis:** hxxps://www[.]huntress[.]com/blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained
- **Detection Guidance:** hxxps://www[.]huntress[.]com/blog/detection-guidance-for-connectwise-cwe-288-2