ScreenConnect Flaws Enabled Setup-Wizard Access, Huntress Says

Summary

Huntress described how attackers could exploit two ScreenConnect flaws, including an authentication bypass, to gain access through the setup wizard. Thousands of servers were vulnerable; attackers reportedly deployed ransomware, coin miners, and remote access tools.

Key points

ConnectWise said on-premises ScreenConnect versions below 23.9.8 were affected by CVE-2024-1709 and CVE-2024-1708 and urged users to patch.
Huntress said the exploit involved adding a slash to the setup-wizard address, allowing an attacker to create credentials and gain access.
Huntress researchers built a proof of concept within hours of the advisory, according to the article.
Huntress reported thousands of vulnerable servers and said attackers used access to deploy ransomware, cryptocurrency miners, and additional remote-access tools.
Huntress sent more than 1,600 incident reports to partners and published detection guidance and Sigma rules.
Huntress also released a temporary mitigation for some vulnerable endpoints; the article says it was deployed before public exploit details and in-the-wild exploitation were known.

Article Details

Vulnerability Types: Authentication bypass
Path traversal
Severity: CVE-2024-1709 was rated CVSS 10/10; the article does not state a severity score for CVE-2024-1708.
Affected Versions: ConnectWise ScreenConnect on-premises versions below 23.9.8
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Huntress released a mitigation vaccine hotfix for hosts running vulnerable versions until they could be patched.