ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

id: CVE-2024-1708

info:
  name: ConnectWise ScreenConnect <= 23.9.7 - Path Traversal
  author: popy21
  severity: high
  description: |
    ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access.
  impact: |
    Attackers can execute remote code or access sensitive data, potentially leading to full system compromise or data breach.
  remediation: |
    Update to the latest version of ConnectWise ScreenConnect.
  reference:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1708
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 8.4
    cve-id: CVE-2024-1708
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: connectwise
    product: screenconnect
    shodan-query: http.favicon.hash:-82958153
    fofa-query: icon_hash=-82958153
  tags: cve,cve2024,connectwise,screenconnect,lfi,kev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(header, "ScreenConnect/")
          - compare_versions(version, '<= 23.9.7')
        condition: and

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
        internal: true

      - type: regex
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
# digest: 4b0a00483046022100a19e34a6c5fd1bf017202e338569c357fbff4001908c4754cb0f17f0b52f8328022100c651232afb9cb4e820c5e39dbb85df0823b9928e52244a7edc0daed0452f4e74:922c64590222798bb761d5b6d8e72950