CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise ScreenConnect contains a path traversal vulnerability. An attacker who can reach the affected system may be able to execute remote code or directly affect confidential data and critical systems. The vulnerability is known to have been used in ransomware attacks.

How it works

The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory. In this class of flaw an attacker supplies crafted input that causes the application to access or write files outside the intended directory. For a remote-access product such as ScreenConnect the result can be arbitrary file operations that lead to code execution or data exposure. Exact attack mechanics and prerequisites must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

• Identify all instances of ConnectWise ScreenConnect used for remote support or unattended access; the software commonly runs on internet-facing servers or cloud-hosted tenants.
• Inventory installations through asset-management tools, configuration-management databases, or network scans for the product’s default ports and services.
• Check the version and configuration of each instance; because no specific version list is provided here, compare every deployment against the vendor advisory to determine whether it is affected.
• Review authentication and logging settings for signs of unexpected file-access or session-creation events that could indicate exploitation attempts.

How to remediate

Apply the vendor-supplied update or mitigation instructions as the primary action. For path-traversal weaknesses in remote-access software, additional hardening steps include restricting which directories the application can read or write and enforcing least-privilege service accounts. Follow any applicable CISA BOD 22-01 guidance for cloud services that host the product.

If you can't patch immediately

• Place affected systems behind network segmentation or access-control lists so that only authorized management networks can reach them.
• Disable or restrict the affected feature if the vendor advisory identifies a configuration option that removes the vulnerable code path.
• Monitor authentication, file-system, and process-creation logs for anomalous activity associated with the product.
• If vendor mitigations cannot be applied, discontinue use of the product until a fix is available.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to data breaches and ransomware deployment. Organizations can run a free exposure scan of their email domains against known breach data to determine whether credentials or other information have already appeared in public data sets.