Huntress Details Host-Header Technique for Running Code Through ConnectWise Control
Summary
Huntress found that Host-header manipulation could make a signed ConnectWise Control installer fetch and run a separate ClickOnce application on on-premises systems. The technique requires user approval and social engineering; cloud instances are not affected.
Key points
- Huntress challenged claims that URL-parameter manipulation in ConnectWise Control enabled remote code execution, saying it could redirect a client connection but still required user deception and an attacker-controlled server.
- Control versions 22.8 and 22.9 mitigated the reported URL-parameter manipulation; cloud instances were updated.
- In a separate investigation, Huntress found that modifying the HTTP Host header could make an installer fetch a supplied ClickOnce application and run its code.
- The demonstrated technique could be used to start a reverse shell, but the ClickOnce application prompts for user approval and remains subject to endpoint security controls.
- Huntress said the Host-header technique applied to on-premises installations, not cloud instances, where the header is used for proxy routing.
- Huntress reported 14 attacks involving Control, rising to 85 in November and more than 60 since the start of December; it described social engineering and phishing as the prevalent threat.
Article Details
- Attack Vectors
- Social-engineering and phishing schemes impersonate help-desk support and persuade users to download and run a legitimate ConnectWise Control client.
- Before Control 22.8, client-download URL parameters h and p could be modified to direct the client to another Control server; the article says this still required user deception and an attacker-controlled server.
- In the demonstrated on-premises scenario, a modified HTTP Host header could make a signed ConnectWise installer retrieve and execute an attacker-provided ClickOnce application. The application installation prompts for user approval; the article says this technique does not work against cloud instances.
- The article describes use of a phone scam in which the caller poses as company support and persuades the victim to install the Control client.
- Defensive Notes
- ConnectWise Control versions 22.8.10013 and 22.9.10032 mitigate the reported URL-parameter redirection; the article says cloud instances were updated as well.
- For on-premises installations, follow ConnectWise installation and hardening guidance, including configuring WebServerAddressableUrl and RelayAddressableUrl to prevent the described proxying technique or specifying an alternate host.
- Provide security-awareness training for end users and system administrators to help them recognize phishing and social-engineering attempts.
- The article says Host-header tampering is ineffective against cloud instances because the Host header is used by the internal proxy for routing.
MITRE ATT&CK
T1105 · Ingress Tool TransferIn the demonstrated on-premises Host-header scenario, the signed installer retrieves a .application file from the supplied location for installation and execution.T1204.002 · Malicious FileThe described scenarios rely on a user downloading and running the Control client and, in the ClickOnce demonstration, approving installation of the downloaded application.T1566.002 · Spearphishing LinkPhishing emails may link to a genuine-looking ConnectWise Control address while using modified client-download parameters to direct the client elsewhere.