Multiple Vulnerabilities Found in ConnectWise ScreenConnect

Published 02/27/2024

I. Targeted Entities

ConnectWise ScreenConnect customers

II. Introduction

A critical authentication bypass has been discovered in ConnectWise’s ScreenConnect, a software for remote desktop access. This exploit could allow attackers to access confidential information and critical systems without proper credentials. Once authenticated via the authentication bypass, attackers can exploit a path-traversal vulnerability to execute remote code within critical systems.

III. Additional Background Information

On February 19, 2024, ConnectWise released a Threat Advisory for patching multiple vulnerabilities discovered in the company’s ScreenConnect software. ScreenConnect is a remote desktop and access software that lets you connect directly to desktops, mobile devices, and more. The vulnerabilities, CVE-2024-1709 and CVE-2024-1708, were first reported on February 13^th. These vulnerabilities have been classified as significantly exploitable, with CVE-2024-1709 receiving a 10.0 critical base score and CVE-2024-1708 receiving an 8.4 high base score by NIST.

The first vulnerability, CVE-2024-1709, involves authentication bypass, which is directly related to CWE-288 – Authentication Bypass Using an Alternate Path or Channel. A flaw was found in a text file named “SetupWizard.aspx”, which has the functionality of setting up the administrative user and installing a license for the system. In unpatched versions, this setup file can be accessed even after the initial setup is completed. This is accomplished by adding additional components after the legitimate URL to the SetupWizard.aspx (/SetupWizard.aspx/[anything]) and exploiting how the .NET framework handles URL paths. The code in the text file does not verify whether the ScreenConnect instance setup has already been completed, allowing anyone to open the setup wizard and overwrite the internal user database, thereby gaining administrative access (Poudel, 2024).

The second vulnerability, CVE-2024-1708, is related to CWE-22 – Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). Although it is considered less severe, it is unlocked by CVE-2024-1079 and should not be underestimated (Team Huntress, 2024). This vulnerability involves manipulating ZIP file paths during extraction. Attackers can then modify these contents and execute malicious code (Poudel, 2024). To do this, a malicious actor needs to have both administrative credentials and create a malicious extension inside C:Program Files (x86)ScreenConnectApp_Extensions to write files anywhere within the folder (Team Huntress, 2024). Team Huntress showed that this ZipSlip attack was not necessary, as malicious actors can run code by accessing a ScreenConnect feature called “Extensions”. This could easily go unnoticed in a system, since no other extensions need to be installed (Team Huntress, 2024).

ConnectWise released a patched version of ScreenConnect on February 21^st, 2024, and recommends updating all versions from 23.9.7 onward to 23.9.8 (ConnectWise, 2024). As of today, February 22^nd, 2024, 3,800 instances of ScreenConnect have been identified as vulnerable and need to be updated to the latest version to prevent malicious actors from accessing the ScreenConnect environment. ConnectWise added that Cloud instances were automatically patched, whereas On-Prem partners need to install all required updates manually to remediate both vulnerabilities (ConnectWise).

V. MITRE ATT&CK

• T1190 – Exploit Public-Facing Applications
  Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Adversaries exploited CVE-2023-3519 to implant a webshell on the organization’s NetScaler ADC appliance.

• T1068 – Exploitation for Privilege Escalation
  Adversaries may exploit software vulnerabilities to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

• T1105 – Ingress Tool Transfer
  Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network via a command-and-control channel or alternative protocols such as FTP. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment.

• T1136 – Create Account
  Adversaries may create an account to maintain access to victim systems. With sufficient access, such accounts can be used to establish secondary credentialed access without deploying persistent remote access tools on the system.

• T1203 – Exploitation for Client Execution
  Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices, leading to unanticipated behavior. Adversaries can exploit certain vulnerabilities to achieve arbitrary code execution.

VI. Recommendations

• On-premise users should immediately upgrade to ScreenConnect version 23.9.8 or later, as these versions patch the vulnerabilities.
• Refer to ConnectWise’s guide for upgrading to the latest software version: "Upgrade an on-premises installation."
• Refer to this link to download the newest ScreenConnect patches: ScreenConnect Patch Download
• It is important to keep all software up to date with the latest patches.
• Check your system for indicators of compromise in the last 30 days.

VII. IOCs (Indicators of Compromise)

CVE-2024-1709