ConnectWise ScreenConnect Authentication Bypass Vulnerability Exploitation

The ConnectWise ScreenConnect CVE-2024-1709 vulnerability allows attackers to bypass authentication and gain unauthorized administrative access. This vulnerability is actively being exploited in the wild. The primary attack vector involves sending malicious HTTP POST requests to the SetupWizard.aspx page, circumventing normal authentication procedures. Successful exploitation can lead to the creation of administrative users, granting the attacker full control over the affected ScreenConnect instance. ConnectWise has released version 23.9.8 to address this vulnerability. This vulnerability has been exploited in conjunction with CVE-2024-1708. Defenders should prioritize detection and patching of vulnerable ScreenConnect instances to prevent potential compromise.

Attack Chain

1. Attacker identifies a vulnerable ConnectWise ScreenConnect instance.
2. The attacker sends a crafted HTTP POST request to /SetupWizard.aspx/ or */SetupWizard.aspx/*.
3. The vulnerable ScreenConnect instance improperly handles the request, bypassing authentication checks.
4. The attacker gains unauthorized access to administrative functions without valid credentials.
5. The attacker creates a new administrative user account.
6. The attacker logs in using the newly created administrative account.
7. The attacker leverages administrative privileges to execute arbitrary code on the server.
8. The attacker establishes persistence and expands their access to the network.

Impact

Successful exploitation of CVE-2024-1709 allows attackers to gain complete control over the ConnectWise ScreenConnect server. This can lead to data breaches, ransomware deployment, and further compromise of connected systems. The number of affected organizations is currently unknown. This impacts MSPs (Managed Service Providers) and their clients since ScreenConnect is used for remote support.

Recommendation

• Deploy the Sigma rule ConnectWise ScreenConnect Authentication Bypass to detect unauthorized access attempts to SetupWizard.aspx in web server logs.
• Upgrade ConnectWise ScreenConnect instances to version 23.9.8 or later to patch CVE-2024-1709 (reference: ConnectWise security bulletin).
• Review web server access logs for suspicious POST requests to SetupWizard.aspx (reference: references section).
• Enable logging for web servers (IIS, Apache) or proxy servers and ensure the logs are ingested into your SIEM.