ConnectWise ScreenConnect Path Traversal and Remote Code Execution Vulnerability Advisory (CVE-2024-1708)

1. Apply Official Security Patch

The primary remediation is to upgrade to the patched version.

• Recommended Version: ConnectWise ScreenConnect 23.9.8 or higher
• On-premise administrators should download the latest installer from the official ConnectWise portal and perform the upgrade immediately.

2. Temporary Mitigations (Pre-patch)

If immediate patching is not feasible, implement the following workarounds to reduce exposure:

• Network Access Control (ACL):

Restrict access to the ScreenConnect console and ports (default 8040, 8041) from the public internet. Limit access to trusted IP ranges or via a secure VPN.

• WAF (Web Application Firewall) Rules:

Deploy WAF rules to detect and block directory traversal patterns in HTTP requests:

  # Block directory traversal sequences in URI and parameters
  (?i)(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)

• Indicators of Compromise (IoC) Monitoring:

Audit the ScreenConnect installation directory, specifically monitoring the App_Extensions folder for unauthorized .ashx or .aspx files.

CVE-2024-1708 is a critical path traversal vulnerability (CWE-22) affecting ConnectWise ScreenConnect.

Due to insufficient input validation, an attacker can use directory traversal sequences (e.g., ../) to access files outside the intended web root directory or write malicious files to arbitrary locations on the server.

In real-world attacks, this vulnerability is frequently chained with the authentication bypass vulnerability (CVE-2024-1709). Once administrative access is gained, threat actors exploit this path traversal flaw to upload web shells or malicious extensions, leading to full system compromise. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, with documented use by ransomware groups such as Medusa.