ConnectWise ScreenConnect Under Active Exploitation, Patch Available

Summary

ConnectWise has released a security update for its ScreenConnect software. Two vulnerabilities are associated with the patch, CVE-2024-1709 (CVSSv3: 10.0) and CVE-2024-1708 (CVSSv3: 8.4) these vulnerabilities can result in an attacker having direct access to confidential information or critical systems or causing remote code execution. These vulnerabilities are currently being utilized by threat actors, the vendor has provided indicators of compromise.

‍

Impact Assessment

These vulnerabilities are high severity and are under active exploitation. They will require an emergency patching cadence if using the on-premises version of the ScreenConnect software.

These vulnerabilities have been researched by Team Huntress and have developed proof of concept code which could be easy to replicate and shows that the vulnerabilities overall are also quite simple to exploit.

CVE-2024-1709 is considered an authentication bypass using an alternate path or channel while CVE-2024-1708 is an improper limitation of a pathname to a restricted directory (“path traversal”). They are both used in conjunction for the attack.

‍

What it means for you

If you are a user of this application this means that your organization should be advised to patch this vulnerability as soon as possible.

‍

Remediation

A patch has been made available, ScreenConnect version 23.9.8 and later will remediate the vulnerabilities.

• If you use the on-prem service of ScreenConnect follow ConnectWise’s guide on how to upgrade an on-premises installation.
• If you use the cloud service of ScreenConnect which are hosted on “screenconnect.com” or “hostedrmm.com” they have been updated to a remediated version.

Indicators of compromise were discovered by the vendor. The follow IP addresses were being used by threat actors:

• 155.133.5.15
• 155.133.5.14
• 118.69.65.60

It is advised to check your environment for any activity from these IPs and block them.

‍

Business Implications

Exploitation of these vulnerabilities would be devastating and has a high likelihood of occurring. Incident response costs, disaster recovery, and business inefficiencies as a result of an exploit would be devastating to the bottom line.

‍

Access Point Technology Recommends

Patch: Follow vendor recommendations and patch on an emergency patching cadence.

Monitor: Perform network monitoring to ensure that this vulnerability has not been exploited and prevent exploitation by blocking the indicators of compromise and ensuring that only legitimate network traffic is running through a system running the ScreenProtect software.

Associated Bulletins

https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8