Full Report
Stay secure with Huntress! Learn about critical vulnerabilities tied to ConnectWise, including CWE-288 authentication bypass. Patch now to version 23.9.8 for protection.
Analysis Summary
# Vulnerability: ConnectWise ScreenConnect Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2024-1709 (primary focus), CVE-2024-1708 (related path traversal)
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-288 (Authentication bypass using an alternate path or channel)
## Affected Systems
- **Products:** ConnectWise ScreenConnect (formerly ConnectWise Control)
- **Versions:** All versions prior to 23.9.8
- **Configurations:** Self-hosted (on-premises) instances are the primary concern; cloud-hosted instances were patched by the vendor.
## Vulnerability Description
CVE-2024-1709 allows a remote, unauthenticated attacker to bypass authentication by exploiting a flaw in the ScreenConnect setup wizard logic. By accessing a specific alternate path, an attacker can re-run the initial setup process on an already-configured server. This allows them to create a new administrative user account, effectively granting full control over the ScreenConnect instance and all managed endpoints.
## Exploitation
- **Status:** Exploited in the wild; PoC available and widely weaponized.
- **Complexity:** Low (requires minimal technical knowledge).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to remote session data and credentials).
- **Integrity:** Total (Ability to execute commands and modify configuration).
- **Availability:** Total (Potential to lock out legitimate admins or delete data).
## Remediation
### Patches
- **Update to version 23.9.8 or higher immediately.** This version removes the vulnerable setup paths and prevents the authentication bypass.
### Workarounds
- **Network Isolation:** Restrict access to the ScreenConnect web interface to trusted IP addresses or via VPN only.
- **Stop Services:** If patching is not immediately possible, stop the ScreenConnect services to prevent remote access.
## Detection
### Indicators of Compromise (IoC)
- **User Creation:** Inspect `C:\Program Files (x86)\ScreenConnect\App_Data\User.xml` for unfamiliar administrative accounts.
- **Null Timestamps:** Look for `0001-01-01T00:00:00` values for `LastLoginDate` or `LastActivityDate` in the `User.xml` file, which may indicate a newly created attacker account that has not yet logged in.
### Detection Methods and Tools
- **Advanced Auditing:** Enable Windows Event ID 4663 (Object Access) to monitor modifications to `User.xml`.
- **File System Monitoring:** Monitor `C:\Windows\Temp\ScreenConnect\` for the creation of temporary XML files during the exploitation process.
- **SIEM Logs:** Monitor web server logs for requests to the setup wizard URL paths (e.g., `/SetupWizard.aspx`) on instances that should already be configured.
## References
- **ConnectWise Advisory:** hXXps://www.connectwise[.]com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- **Huntress Technical Analysis:** hXXps://www.huntress[.]com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- **General Guidance:** hXXps://www.huntress[.]com/blog/detection-guidance-for-connectwise-cwe-288-2