Threat Brief: ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)

This post is also available in: 日本語 (Japanese)

Executive Summary

Feb. 13, 2024, ConnectWise was notified of two vulnerabilities impacting their remote desktop software application ScreenConnect. These vulnerabilities were first reported through their vulnerability disclosure channel in the ConnectWise Trust Center.

Feb. 19, 2024, ConnectWise publicly disclosed the vulnerabilities in a security bulletin.

As of Feb. 21, 2024, Unit 42 observed 18,188 unique IP addresses hosting ScreenConnect globally.

The newly disclosed vulnerabilities have now been assigned the following CVEs:

The authentication bypass vulnerability (CVE-2024-1709) is considered to be trivially exploitable, and proof-of-concept exploits are already available. Metasploit has released an unauthenticated remote code execution (RCE) exploit module for this vulnerability.

We assess with high confidence that this vulnerability will be actively targeted by various types of threat actors, including cybercriminals and nation-state actors, given the severity and scope of the vulnerability and the nature of the impacted product.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-1709 to the Known Exploited Vulnerabilities Catalog. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, Federal Civilian Executive Branch agencies are required to address vulnerabilities identified in the catalog by the assigned due date. For this vulnerability the due date for remediation is Feb 29, 2024.

Current Scope of the Attack

Unit 42 is providing Incident Response support to customers related to these vulnerabilities.

ConnectWise has confirmed that it has “received updates of compromised accounts that our incident response team have been able to investigate and confirm.”

As of Feb. 21, 2024, Unit 42 observed 18,188 unique IP addresses hosting ScreenConnect globally.

Earlier scans showed that nearly three-quarters of these hosts were in the U.S. The top ten countries accounted for over 95% of global exposure. Our observations are summarized in Figure 1 and Table 1.

Table 1. Top ten countries with ConnectWise ScreenConnect exposure.

Mitigation Actions

The ConnectWise bulletin indicates that ScreenConnect servers hosted in screenconnect[.]com cloud or hostedrmm[.]com have been updated to remediate the issue and no end user action is required. For those with self-hosted or on-premise deployments, the guidance is to patch as soon as possible.

ConnectWise has removed license restrictions so that older versions can be upgraded even if no longer under maintenance.

Conclusion

Unit 42 will continue to monitor the situation and will update this post as more information becomes available.

Palo Alto Networks Product Protections for ConnectWise Vulnerabilities

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America Toll-Free: 866.486.4842 (866.4.UNIT42)
• EMEA: +31.20.299.3130
• APAC: +65.6983.8730
• Japan: +81.50.1790.0200

Next-Generation Firewalls and Prisma Access With Advanced Threat Prevention

Next-Generation Firewall with the Advanced Threat Prevention security subscription an help block the attacks with best practices via the following Threat Prevention signatures 95048.

Cloud-Delivered Security Services for the Next-Generation Firewall

Advanced URL Filtering categorizes exploit and scanning attempts as Scanning Activity. Advanced URL Filtering and DNS Security categorize as malicious known domains/IPs associated with this activity.

Cortex XDR and XSIAM

Cortex XDR and XSIAM help protect against post-exploitation activities using the multi-layer protection approach.

Cortex Xpanse

Cortex Xpanse has added Attack Surface Rules for both generic ConnectWise ScreenConnect as well as known insecure versions of identified ConnectWise ScreenConnect instances. These rules are also available to XSIAM customers who have purchased the ASM module.

Additionally, Cortex Xpanse has published a new Threat Response Center event for this pair of vulnerabilities.

Indicators of Compromise

ConnectWise has identified the following IoCs, which were recently used by threat actors:

• 155.133.5[.]15
• 155.133.5[.]14
• 118.69.65[.]60

Sophos has identified the following IoCs. See their research on ConnectWise linked below.

Additional Resources

• ConnectWise ScreenConnect attacks deliver malware – Sophos X-Ops

Updated Feb. 23, 2024, at 6:13 a.m. PT to add additional information to the Executive Summary, Scope of Attack and Mitigations sections, including an update from CISA and other news. Added a Next-Generation Firewall Threat Prevention signature. 

Updated Feb. 29, 2024, at 12:40 p.m. PT to add new IoCs from Sophos, an Additional Resources section, and expanded protections for Next-Generation Firewall. 

Updated March 4, 2024, at 7:00 a.m. PT to add IPs to protections for Next-Generation Firewall.