Full Report
Huntress has validated the vulnerabilities referred to in the latest February 19 ConnectWise ScreenConnect advisory. For on-premise users, it is our strongest recommendation to patch and update to ScreenConnect version 23.9.8 immediately.
Analysis Summary
# Vulnerability: ConnectWise ScreenConnect Authentication Bypass and Path Traversal
## CVE Details
- **CVE ID:** CVE-2024-1709 (Primary), CVE-2024-1708
- **CVSS Score:** 10.0 (Critical) for CVE-2024-1709; 8.4 (High) for CVE-2024-1708
- **CWE:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
## Affected Systems
- **Products:** ConnectWise ScreenConnect (formerly ConnectWise Control)
- **Versions:** All versions prior to 23.9.8
- **Configurations:** Primarily impacts on-premise installations. Internet-facing servers are at highest risk (over 8,800 vulnerable servers identified via Censys at the time of reporting).
## Vulnerability Description
The flaw consists of two primary issues. The most critical (CVE-2024-1709) is an authentication bypass that allows an attacker to access the setup wizard of an already configured ScreenConnect instance by using an alternate URL path. By re-running the setup, an attacker can create a new administrative account, gaining full control over the application. The second flaw (CVE-2024-1708) is a path traversal vulnerability that allows an authenticated attacker (often using the bypass mentioned above) to access or execute files outside of restricted directories.
## Exploitation
- **Status:** PoC available and validated by Huntress researchers; exploited in the wild (post-report updates confirm active exploitation).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Critical) - Full access to the ScreenConnect console and managed endpoints.
- **Integrity:** Total (Critical) - Ability to execute remote code and modify system configurations.
- **Availability:** Total (Critical) - Potential for complete system takeover or ransomware deployment.
## Remediation
### Patches
- **ScreenConnect Version 23.9.8:** Immediately update to this version to resolve both vulnerabilities.
- **Cloud Users:** No action required; ConnectWise has automatically updated cloud-hosted instances.
### Workarounds
- **Huntress Hotfix:** For managed Huntress agents, a temporary hotfix was deployed to block exploitation attempts while admins prepared for the official patch.
- **IP Whitelisting:** Restrict access to the ScreenConnect web interface to known, trusted IP addresses only.
## Detection
- **Indicators of Compromise:**
- Look for unauthorized user creation within the ScreenConnect User Management panel.
- Monitor for logs indicating access to the `/SetupWizard.aspx` page on previously configured servers.
- Check for suspicious files in the ScreenConnect extensions directory or unusual child processes (e.g., `cmd.exe` or `powershell.exe`) spawned by the `ScreenConnect.Service.exe`.
- **Detection methods and tools:** Huntress has issued specific detection guidance for CWE-288 and recommends monitoring for autoruns found on endpoints.
## References
- **Vendor Advisory:** hxxps[://]www[.]connectwise[.]com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- **Huntress Analysis:** hxxps[://]www[.]huntress[.]com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- **Detection Guidance:** hxxps[://]www[.]huntress[.]com/blog/detection-guidance-for-connectwise-cwe-288-2