Full Report
Huntress gives you a non-technical breakdown of the SlashAndGab ConnectWise ScreenConnect Vulnerability; dig into the insights on how we discovered it and supported the community along the way.
Analysis Summary
# Vulnerability: SlashAndGrab (ConnectWise ScreenConnect Authentication Bypass)
## CVE Details
- **CVE ID**: CVE-2024-1709 (Primary), CVE-2024-1708 (Secondary)
- **CVSS Score**: 10.0 (Critical)
- **CWE**: CWE-288 (Authentication Bypass Using an Alternate Path), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
## Affected Systems
- **Products**: ConnectWise ScreenConnect (formerly ConnectWise Control)
- **Versions**: All versions prior to 23.9.8 (on-premise)
- **Configurations**: Specifically impacts on-premise installations; cloud instances were automatically mitigated by the vendor.
## Vulnerability Description
The vulnerability, nicknamed "SlashAndGrab," is a trivial authentication bypass. It stems from an issue in how the application handles URL paths. By appending a forward slash (`/`) to the setup wizard URL (e.g., `setupwizard.aspx/`), an attacker can trick the application into believing the initial setup has not been completed.
This bypass allows an unauthenticated remote attacker to access the administrative setup page, create a new administrative user account, and subsequently gain full control over the ScreenConnect server and all managed endpoints.
## Exploitation
- **Status**: Exploited in the wild (Extensive active exploitation reported within 48 hours of discovery).
- **Complexity**: Low (Described as "embarrassingly easy" and "trivial").
- **Attack Vector**: Network (Remote)
- **PoC Availability**: Publicly available and easily reproducible.
## Impact
- **Confidentiality**: Total (Full access to remote management capabilities and sensitive data).
- **Integrity**: Total (Attackers can create admin accounts and modify system configurations).
- **Availability**: Total (Attackers can lock out legitimate users or shut down services).
## Remediation
### Patches
- **ConnectWise ScreenConnect Version 23.9.8**: Users must update to this version or higher immediately to resolve the flaw.
### Workarounds
- There are no recommended functional workarounds that replace patching. If patching is not immediately possible, the server should be taken offline or restricted via firewall to trusted IP addresses only.
## Detection
- **Indicators of Compromise (IoCs)**:
- Unexpected access to `SetupWizard.aspx`.
- Creation of new, unauthorized administrative user accounts.
- Presence of a forward slash in web server logs following the `.aspx` extension.
- **Detection Methods**:
- Monitor application logs for HTTP 200 responses to `/SetupWizard.aspx/`.
- Inspect the `User.xml` file for newly created accounts that do not correlate with known administrative actions.
## References
- **Huntress Technical Analysis**: hxxps://www[.]huntress[.]com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- **Detection Guidance**: hxxps://www[.]huntress[.]com/blog/detection-guidance-for-connectwise-cwe-288-2
- **Vendor Advisory**: ConnectWise Trust Center (Referenced via hxxps://www[.]huntress[.]com/blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained)