CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability

Executive Summary

A high-severity path traversal vulnerability (CVE-2024-1708) in ConnectWise ScreenConnect has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. The flaw allows an attacker to execute remote code or directly impact confidential data and critical systems by bypassing path restrictions within the ScreenConnect file handling functionality.

CVE-2024-1708 was disclosed alongside CVE-2024-1709 (a critical authentication bypass), and the two are frequently chained together in attacks. Federal Civilian Executive Branch (FCEB) agencies are required to remediate per CISA's binding operational directive. All organizations running ScreenConnect on-premises should treat this as an urgent, high-priority patch.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The vulnerability resides in ScreenConnect's file handling and upload functionality. User-supplied path components are not properly normalized or restricted to an allowed directory tree. By supplying path traversal sequences (e.g., ../../) in file paths, an attacker can:

• Write arbitrary files outside the intended directory
• Overwrite application configuration or code
• Achieve remote code execution in the context of the ScreenConnect service account

Attack Chain with CVE-2024-1709

CVE-2024-1708 is most dangerous when chained with CVE-2024-1709, an authentication bypass that allows an unauthenticated attacker to create a new administrative user account:

1. Attacker identifies a ScreenConnect instance reachable from the internet
2. CVE-2024-1709: Attacker bypasses authentication — creates rogue admin account
3. Authenticated as new admin, attacker exploits CVE-2024-1708
4. Crafts a path traversal payload in file upload or management endpoint
5. Writes a web shell or malicious file outside the ScreenConnect web root
6. Executes uploaded code — achieves full RCE on the ScreenConnect host
7. Post-exploitation: credential harvesting, lateral movement, ransomware staging

Why This Is Dangerous

Impact Assessment

Immediate Remediation

Step 1: Upgrade ScreenConnect Immediately

Apply the security patch released by ConnectWise. The fixed version is 23.9.8:

# Check your current ScreenConnect version
# Navigate to Admin > About in the ScreenConnect web interface
 
# For cloud-hosted ScreenConnect (ScreenConnect.com):
# ConnectWise has already patched cloud instances — no action needed
 
# For on-premises installations:
# Download the latest installer from ConnectWise partner portal
# Stop the ScreenConnect service before upgrading
net stop ScreenConnect
# Run the installer to upgrade
# Restart and verify the new version

Step 2: Verify No Compromise Occurred

# Check for unexpected files in the ScreenConnect web root
# Default path (Windows): C:\Program Files (x86)\ScreenConnect\
dir "C:\Program Files (x86)\ScreenConnect\App_Extensions\" /s /b *.aspx
dir "C:\Program Files (x86)\ScreenConnect\App_Extensions\" /s /b *.ashx
dir "C:\Program Files (x86)\ScreenConnect\App_Extensions\" /s /b *.php
 
# Review Windows Event Logs for new admin account creation
Get-WinEvent -LogName Security | Where-Object {$_.Id -eq 4720} | Select-Object TimeCreated, Message | Format-List
 
# Check for unauthorized ScreenConnect admin accounts
# Navigate to Admin > Users in the ScreenConnect web interface

Step 3: Restrict Internet Exposure

If immediate patching is not possible:

# Block external access to ScreenConnect relay port (default 443/8040)
# via Windows Firewall or perimeter firewall until patched
New-NetFirewallRule -DisplayName "Block SC External" -Direction Inbound `
  -LocalPort 443,8040 -Protocol TCP -Action Block `
  -RemoteAddress "0.0.0.0/0" -Enabled True

Step 4: Post-Patch Hardening

# After upgrading, review and tighten ScreenConnect access controls:
# 1. Enable two-factor authentication for all ScreenConnect admin accounts
# 2. Review the admin user list and remove any unrecognized accounts
# 3. Restrict the admin interface to known IP ranges if possible
# 4. Enable audit logging for all ScreenConnect admin actions
# 5. Rotate ScreenConnect service account credentials

Detection Indicators

Post-Remediation Checklist

1. Upgrade ConnectWise ScreenConnect to version 23.9.8 or later
2. Audit the admin user list — remove any accounts not recognized by your team
3. Reset all admin passwords after upgrading
4. Scan the web root for unexpected .aspx, .ashx, or other script files
5. Review Windows Security Event Log for Event ID 4720 (account creation) near the disclosure date
6. Check all managed endpoints for signs of lateral movement from the ScreenConnect server
7. Enable 2FA on all ScreenConnect administrator accounts
8. Restrict the admin panel to known IP ranges or VPN access only
9. Notify clients if you are an MSP — all managed environments should be assessed for post-compromise indicators
10. Monitor for re-exploitation until upgrade is confirmed across all on-premises deployments

References

• NVD — CVE-2024-1708
• CISA Known Exploited Vulnerabilities Catalog
• ConnectWise Security Advisory