CVE-2024-1708: ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

id: CVE-2024-1708

info:
  name: ConnectWise ScreenConnect <= 23.9.7 - Path Traversal
  author: popy21
  severity: high
  description: |
    ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access.
  impact: |
    Attackers can execute remote code or access sensitive data, potentially leading to full system compromise or data breach.
  remediation: |
    Update to the latest version of ConnectWise ScreenConnect.
  reference:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1708
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 8.4
    cve-id: CVE-2024-1708
    epss-score: 0.9549
    epss-percentile: 0.99866
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: connectwise
    product: screenconnect
    shodan-query: http.favicon.hash:-82958153
    fofa-query: icon_hash=-82958153
  tags: cve,cve2024,connectwise,screenconnect,lfi,kev,vkev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(header, "ScreenConnect/")
          - compare_versions(version, '<= 23.9.7')
        condition: and

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
        internal: true

      - type: regex
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
# digest: 4b0a00483046022100facefdb2fff1c7531913a4acac4819311a2ce011c4d14ddf7ebb13c5b91b081a0221008e2d0a8176ea685cbd06ad91e79fe32d17eca55d9e08b584c2079ef58108bed9:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.