Attack Chain

1. Attacker identifies a vulnerable ConnectWise ScreenConnect instance.
2. The attacker sends a crafted HTTP POST request to /SetupWizard.aspx/ or */SetupWizard.aspx/*.
3. The vulnerable ScreenConnect instance improperly handles the request, bypassing authentication checks.
4. The attacker gains unauthorized access to administrative functions without valid credentials.
5. The attacker creates a new administrative user account.
6. The attacker logs in using the newly created administrative account.
7. The attacker leverages administrative privileges to execute arbitrary code on the server.
8. The attacker establishes persistence and expands their access to the network.

Impact

Successful exploitation of CVE-2024-1709 allows attackers to gain complete control over the ConnectWise ScreenConnect server. This can lead to data breaches, ransomware deployment, and further compromise of connected systems. The number of affected organizations is currently unknown. This impacts MSPs (Managed Service Providers) and their clients since ScreenConnect is used for remote support.

Recommendation

• Deploy the Sigma rule ConnectWise ScreenConnect Authentication Bypass to detect unauthorized access attempts to SetupWizard.aspx in web server logs.
• Upgrade ConnectWise ScreenConnect instances to version 23.9.8 or later to patch CVE-2024-1709 (reference: ConnectWise security bulletin).
• Review web server access logs for suspicious POST requests to SetupWizard.aspx (reference: references section).
• Enable logging for web servers (IIS, Apache) or proxy servers and ensure the logs are ingested into your SIEM.