Description
ConnectWise ScreenConnect存在目录遍历漏洞，此漏洞是由于从ZIP文件提取内容时未充分验证文件路径导致的。
ConnectWise ScreenConnect CVE-2024-1708 目录遍历漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2024-1708
https://www.huntress.com/threat-library/vulnerabilities/cve-2024-1708
https://www.sentinelone.com/vulnerability-database/cve-2024-1708/
https://www.ibm.com/think/insights/remote-access-risks-cve20241708-cve20241709
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
https://www.cve.org/CVERecord?id=CVE-2024-1708
https://zone.huoxian.cn/d/2898-connectwise-screenconnect-rcecve-2024-1709cve-2024-1708
https://wlzx.yau.edu.cn/info/1127/3427.htm
https://avd.aliyun.com/detail?id=AVD-2024-1708
https://www.aqtd.com/nd.jsp?id=6001
https://www.anquanke.com/post/id/293407
https://community.fortinet.com/blogs-103/path-traversal-vulnerability-in-connectwise-screenconnect-cve-2024-1708-196002
https://docs.indusface.com/en/article/screenconnect-authentication-bypass-cve-2024-1709-cve-2024-1708
https://www.tenable.com/cve/CVE-2024-1708/plugins
https://unit42.paloaltonetworks.com/connectwise-threat-brief-cve-2024-1708-cve-2024-1709/
https://research.splunk.com/endpoint/56a3ac65-e747-41f7-b014-dff7423c1dda/