Critical ConnectWise ScreenConnect flaw exploited in the wild

A essential vulnerability patched this week within the ConnectWise ScreenConnect distant desktop software program is already being exploited within the wild. Researchers warn that it’s trivial to use the flaw, which permits attackers to bypass authentication and achieve distant code execution on methods, and proof-of-concept exploits exist already.

ScreenConnect is a well-liked distant assist instrument with each on-premises and in-cloud deployments. Based on ConnectWise’s advisory launched Monday, the cloud deployments hosted at screenconnect.com or hostedrmm.com have mechanically been patched, however clients must urgently improve their on-premises deployments to model 23.9.8.

Information from web scanning service Censys confirmed over 8,000 susceptible ScreenConnect servers when the vulnerability was disclosed. Nevertheless, the affect of a profitable exploit might lengthen previous the server itself since a single ScreenConnect server might present attackers with entry to a whole bunch or hundreds of endpoints — even throughout a number of organizations if the server is run by a managed service supplier (MSP).

Attackers have exploited vulnerabilities in distant monitoring and administration (RMM) instruments utilized by MSPs up to now to achieve entry to their clients’ networks, and so they additionally abused such instruments for command-and-control in different assaults. Final month, the US Cybersecurity and Infrastructure Safety Company (CISA), the Nationwide Safety Company (NSA), and the Multi-State Data Sharing and Evaluation Heart (MS-ISAC) issued a joint advisory a couple of malicious marketing campaign that concerned phishing emails that led to the obtain of reliable RMM software program, equivalent to ScreenConnect and AnyDesk, that attackers then used to steal cash from victims’ financial institution accounts in a refund rip-off.

In its unique advisory, ConnectWise stated there was no proof of the 2 vulnerabilities it disclosed being exploited within the wild, however someday later it up to date its advisory to warn clients that: “We acquired updates of compromised accounts that our incident response group have been in a position to examine and make sure.”

Authentication bypass within the ScreenConnect setup wizard

The ScreenConnect patch addresses two vulnerabilities that don’t but have CVE identifiers: An authentication bypass that’s rated with the utmost rating of 10 (Essential) on the CVSS severity scale and an improper limitation of a pathname to a restricted listing, also called a path traversal flaw, that’s rated 8.4 (Excessive).