Huntress Explains ScreenConnect Authentication Bypass and Path-Traversal Exploits
Summary
Huntress recreated ScreenConnect exploits for CVE-2024-1709 and CVE-2024-1708, explaining how the authentication bypass can enable administrator access and how path traversal can write files. ConnectWise patched on-premises versions in 23.9.8.
Key points
- CVE-2024-1709 allowed access to the setup wizard by adding a trailing path segment to SetupWizard.aspx, enabling an attacker to create an administrator account.
- Huntress said creating the account overwrites ScreenConnect’s internal user database and removes other local users.
- Once an attacker has administrator access, the legitimate Extensions feature can run .NET code as SYSTEM on the server.
- CVE-2024-1708 involved ZIP path traversal when handling extensions; Huntress said it could write files outside an extension’s subdirectory.
- ConnectWise advised on-premises users of ScreenConnect 23.9.7 and earlier to update to 23.9.8; cloud instances had been automatically patched.
- Huntress shared detection guidance for suspicious setup-wizard requests and file changes, noting that one temporary XML-file detection can produce false positives.
Article Details
- Attack Vectors
- CVE-2024-1709 authentication bypass: appending a path segment to /SetupWizard.aspx can allow access to the setup wizard on configured ScreenConnect instances.
- CVE-2024-1708 path traversal in ZIP extraction can allow a malicious extension to write files outside its extension subdirectory within App_Extensions.
- After gaining administrative access, an attacker can upload a malicious ScreenConnect extension that executes .NET code as SYSTEM.
- Defensive Notes
- Update all on-premise ScreenConnect instances at version 23.9.7 or below to version 23.9.8; the article says cloud instances were automatically patched.
- Review IIS logs for requests to SetupWizard.aspx with a trailing path segment; Huntress states this behavior is never legitimate.
- Inspect the root of C:\Program Files (x86)\ScreenConnect\App_Extensions\ for unexpected .aspx or .ashx files; the article says ScreenConnect does not normally place files there.
- Use the described Sigma detections for file modifications at the root of App_Extensions and temporary XML user-database writes. The XML-write detection can produce false positives during legitimate user or permission changes.
- For Windows Event ID 4663 detections, configure Advanced Auditing and apply an appropriate SACL to the directory.
MITRE ATT&CK
T1105 · Ingress Tool TransferAfter gaining administrative access, an attacker can upload a malicious ScreenConnect extension to the server.T1136.001 · Local AccountThe setup wizard can be used after the bypass to create new administrative credentials and overwrite the local user database.T1190 · Exploit Public-Facing ApplicationThe described attack exploits ScreenConnect's authentication bypass and path traversal vulnerabilities against ScreenConnect instances.