Full Report
The Huntress team validates eight vulnerabilities found in ConnectWise Control that ranged from low to high severity.
Analysis Summary
# Vulnerability: ConnectWise Control Multi-Vulnerability Suite (Bishop Fox Findings)
## CVE Details
*Note: The source text identifies eight vulnerabilities; the primary high-profile identifier discussed is below.*
- **CVE ID:** CVE-2019-16512 (Stored XSS), among others (CVE-2024-1709 & CVE-2024-1708 referenced as subsequent critical findings)
- **CVSS Score:** Range from Low to Critical (Specific scores vary by CVE; ScreenConnect Auth Bypass is 10.0)
- **CWE:** CWE-79 (Cross-site Scripting), CWE-288 (Authentication Bypass), CWE-94 (Code Injection)
## Affected Systems
- **Products:** ConnectWise Control (formerly ScreenConnect)
- **Versions:** Versions prior to January 2020 (specifically 19.6 and earlier for the initial eight; versions prior to 23.9.8 for 2024 exploits).
- **Configurations:** Self-hosted (on-premise) installations are at highest risk; trial instances were historically vulnerable to customization-based XSS.
## Vulnerability Description
The vulnerability suite covers several attack vectors:
1. **Appearance Modifier XSS:** A stored Cross-Site Scripting flaw where the application's legitimate branding/customization feature allowed the injection of malicious JavaScript. This could be used to execute code in the context of other users visiting the Control portal.
2. **Authentication Bypass (CVE-2024-1709):** A critical flaw allowing an attacker to bypass authentication mechanisms to gain administrative access.
3. **Path Traversal (CVE-2024-1708):** Allows an authenticated attacker to access files outside of the intended directory, potentially leading to Remote Code Execution (RCE).
## Exploitation
- **Status:** PoC available and exploited in the wild (specifically for the 2024 Auth Bypass findings). The XSS flaw was validated but largely mitigated via policy changes.
- **Complexity:** Low (for many of the validated flaws).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Total access to remote sessions and stored credentials).
- **Integrity:** High (Ability to modify system configurations and appearance).
- **Availability:** High (Potential to lock out legitimate administrators or crash services).
## Remediation
### Patches
- **ConnectWise Control 23.9.8:** Critical patch for the 2024 Auth Bypass and Path Traversal.
- **Historical Patches:** Versions released post-January 2020 addressed the initial Bishop Fox findings.
### Workarounds
- **Trial Restrictions:** ConnectWise disabled appearance customization for trial accounts to prevent XSS hosting.
- **IP Whitelisting:** Restrict access to the Control administrative interface to known-good IP addresses.
- **2FA:** Enforce Mandatory Two-Factor Authentication for all administrative accounts.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected script tags in appearance customization settings.
- Creation of unauthorized administrative users via the `/SetupWizard.aspx` (in the case of CVE-2024-1709).
- Logs showing access to the `App_Extensions` folder or unauthorized file uploads.
- **Detection methods and tools:**
- Huntress External Recon tools for identifying exposed/unpatched instances.
- Reviewing ConnectWise Control `Security.audit` logs for abnormal user creation.
## References
- ConnectWise Security Matrix: hxxps[://]www.connectwise[.]com/security/advisories
- Huntress Blog: hxxps[://]www.huntress[.]com/blog/validating-the-bishop-fox-findings-in-connectwise-control
- CVE Mitre: hxxps[://]cve.mitre[.]org/cgi-bin/cvename.cgi?name=CVE-2019-16512