CVE-2024-1708: ConnectWise ScreenConnect Path Traversal

CVE-2024-1708 Overview

ConnectWise ScreenConnect 23.9.7 and prior versions are affected by a path traversal vulnerability (CWE-22) that may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems. This vulnerability poses significant risks to organizations using ScreenConnect for remote access and support operations.

Critical Impact

Attackers can exploit this path traversal flaw to access files outside the intended directory, potentially leading to remote code execution or unauthorized access to sensitive system data.

Affected Products

• ConnectWise ScreenConnect versions 23.9.7 and prior
• All deployments of vulnerable ScreenConnect server instances
• Both cloud-hosted and on-premises installations

Discovery Timeline

• 2024-02-21 - CVE-2024-1708 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1708

Vulnerability Analysis

This path traversal vulnerability in ConnectWise ScreenConnect allows attackers to manipulate file paths to access directories and files outside of the intended scope. The flaw exists in how the application handles user-supplied input when processing file requests, failing to properly sanitize directory traversal sequences.

The vulnerability requires network access and high privileges to exploit, but successful exploitation can have a changed scope affecting confidentiality, integrity, and availability of both the vulnerable system and potentially connected systems. Given that ScreenConnect is widely used by managed service providers (MSPs) and IT support teams, a successful attack could provide access to numerous downstream client environments.

Root Cause

The root cause of this vulnerability is improper input validation when handling file path parameters. The application fails to adequately sanitize or validate user-supplied input containing directory traversal sequences such as ../ or ..\, allowing attackers to escape the intended directory structure and access arbitrary files on the server.

This type of vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) occurs when software uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize special elements that can cause the pathname to resolve to a location outside of that directory.

Attack Vector

The attack is network-based, meaning it can be executed remotely against vulnerable ScreenConnect instances exposed to the network. An authenticated attacker with elevated privileges can craft malicious requests containing path traversal sequences to navigate outside the application's root directory.

The vulnerability mechanism involves manipulating file path parameters in HTTP requests to the ScreenConnect server. By including directory traversal sequences, attackers can potentially read sensitive configuration files, access credentials, or write malicious files to arbitrary locations that could lead to code execution.

For detailed technical analysis of this vulnerability and related ScreenConnect security issues, refer to the Huntress Blog Analysis.

Detection Methods for CVE-2024-1708

Indicators of Compromise

• HTTP requests to ScreenConnect containing directory traversal sequences (../, ..\, %2e%2e%2f, %2e%2e/)
• Unusual file access patterns in ScreenConnect server logs indicating attempts to access files outside the web root
• Unexpected file modifications or new files appearing in system directories on ScreenConnect servers
• Authentication anomalies combined with suspicious file operation requests

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns
• Monitor ScreenConnect server access logs for requests with encoded directory traversal sequences
• Deploy endpoint detection solutions to identify suspicious file system access originating from ScreenConnect processes
• Establish baseline network behavior for ScreenConnect servers and alert on deviations

Monitoring Recommendations

• Enable verbose logging on ScreenConnect servers to capture detailed request information
• Configure SIEM rules to correlate ScreenConnect access patterns with file system events
• Monitor for unexpected process spawning from ScreenConnect server processes
• Track privileged user activity within ScreenConnect for anomalous behavior patterns

How to Mitigate CVE-2024-1708

Immediate Actions Required

• Upgrade ConnectWise ScreenConnect to version 23.9.8 or later immediately
• Audit ScreenConnect server logs for any signs of exploitation attempts
• Review system integrity on servers running vulnerable versions to check for unauthorized changes
• Restrict network access to ScreenConnect management interfaces to trusted IP ranges

Patch Information

ConnectWise has released version 23.9.8 to address this path traversal vulnerability. Organizations should apply this update immediately to all affected ScreenConnect installations. The official security bulletin with patch details is available at the ConnectWise Security Bulletin.

For cloud-hosted ScreenConnect instances, ConnectWise may have automatically applied updates. On-premises deployments require manual patching by administrators.

Workarounds

• If immediate patching is not possible, restrict network access to ScreenConnect servers using firewall rules
• Implement additional access controls to limit which users can perform file operations
• Deploy web application firewall rules to filter requests containing directory traversal patterns
• Consider temporarily disabling external access to ScreenConnect until the patch can be applied

# Example: Restrict ScreenConnect access to specific IP ranges using iptables
iptables -A INPUT -p tcp --dport 8040 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8040 -j DROP
iptables -A INPUT -p tcp --dport 8041 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8041 -j DROP