Full Report
ConnectWise has disclosed that it's planning to rotate the digital code signing certificates used to sign ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security concerns. The company said it's doing so "due to concerns raised by a third-party researcher about how ScreenConnect handled certain configuration data in earlier versions.
Analysis Summary
# Vulnerability: Insecure Configuration Data Handling Leading to Code Signing Certificate Rotation
## CVE Details
- **CVE ID:** Not explicitly assigned in the provided text. The issue relates to a pre-emptive action based on identified security concerns, not a confirmed, cataloged CVE.
- **CVSS Score:** Not specified.
- **CWE:** Insecure Design / Improper Data Handling (Inferred from the description of storing configuration data in an unsigned installer area).
## Affected Systems
- **Products:** ScreenConnect, ConnectWise Automate, ConnectWise Remote Monitoring and Management (RMM) executables.
- **Versions:** Earlier versions of ScreenConnect (specific versions not listed, but actions are taken around prior builds).
- **Configurations:** On-premise deployments of ScreenConnect or Automate are specifically called out as requiring user action.
## Vulnerability Description
The vulnerability stems from an insecure design pattern where ScreenConnect installers store configuration data, such as the agent callback URL, in an area of the installer that is **not digitally signed** by the certificate, although it is part of the installer package. While this feature was reportedly used for legitimate customization, coupling it with the capabilities of a remote control solution creates a security risk based on current standards. ConnectWise is addressing this by rotating the code signing certificates and updating how this configuration data is managed in new product builds.
## Exploitation
- **Status:** No indication of active exploitation in the wild related to this specific certificate handling issue. It appears to be a finding by a third-party researcher.
- **Complexity:** Not specified, but the potential impact relates to manipulating configuration information that affects post-install connectivity.
- **Attack Vector:** Inferred to involve manipulation during the installation process if an attacker could influence the creation or modification of the unsigned configuration data area.
## Impact
- **Confidentiality:** Potential for exposure or manipulation of configuration data (e.g., the callback URL).
- **Integrity:** Potential to influence the integrity of the connection setup between agent and server.
- **Availability:** Risk of service disruption for on-premise users who fail to update before certificates are revoked.
## Remediation
### Patches
ConnectWise is immediately implementing enhancements and releasing updates:
- **Cloud Instances (Automate & RMM):** Updates are being applied automatically by ConnectWise.
- **On-Premise Users (ScreenConnect/Automate):** Users must update to the latest build and ensure all agents are updated before the cutoff date (June 13 at 8 p.m. ET / June 14, 12 a.m. UTC).
### Workarounds
None explicitly detailed beyond ensuring timely patching/updating before the certificate revocation deadline. Connectivity may be disrupted if agents are running on old builds after the certificate rotation occurs.
## Detection
- **Indicators of Compromise:** Not explicitly provided for this specific configuration issue, as the focus is on proactive remediation.
- **Detection Methods and Tools:** Monitoring successful application of the latest ScreenConnect/Automate builds and agent versions.
## References
- Vendor Advisory/Trust Center: hxxps://www.connectwise.com/company/trust/advisories
- Community Discussion (Configuration details shared): hxxps://www.reddit.com/r/sysadmin/comments/1l6qsao/connectwise_rotating_signing_certs_due_to/