VULNERABILITY DIGEST FROM ACTION1

Patch Tuesday and third-party updates | This Wednesday | 12 PM EST / 6 PM CET

Action1 5 Blog 5 Identifying Endpoints Vulnerable to CVE-2024-1708 & CVE-2024-1709

Identifying Endpoints Vulnerable to CVE-2024-1708 & CVE-2024-1709

March 13, 2024

By Peter Barnett

ConnectWise has urgently patched a critical authentication bypass vulnerability (rated 10/10) and a path traversal flaw (rated 8.4/10) in ScreenConnect versions 23.9.7 and below. These vulnerabilities enable access to sensitive data and remote code execution without user interaction. Despite the prompt release of the patch, rapid exploitation has followed. While cloud servers have been secured, on-premises users are strongly urged to upgrade to version 23.9.8 immediately.

ConnectWise has also reported several breaches of ScreenConnect accounts due to vulnerabilities CVE-2024-1708 and CVE-2024-1709. According to ShadowServer, approximately 93% of ScreenConnect servers remain vulnerable, and these security gaps have already been leveraged in ransomware attacks.
Given the escalating threat posed by these vulnerabilities, Action1 has developed two scripts to assist in scanning systems for possible remote-control software as well as indicators of compromise specifically related to this vulnerability as reported by BitDefender. These scripts were designed to be used in Action1 (instructions below) but can be used stand alone or with any endpoint management/RMM system.

How to identify unauthorized remote-control tools on your network

Remote control software is indispensable for productivity and remote support but can introduce vulnerabilities if not managed correctly. Likewise threat actors will often use commercially available tools to maintain control of compromised systems. Due to these being legitimate software products, they can often slide under the radar of your typical threat hunting tools. To assist IT administrators in safeguarding their networks, Action1 has developed a PowerShell script to assist with finding these tools for further scrutiny. This script is designed to provide comprehensive insights into the presence of common remote access applications, such as AnyDesk, ConnectWise, TeamViewer, Splashtop, among others, across networks. It can identify up to *147 known remote-control applications, reporting their versions for enhanced monitoring. This functionality enables detailed reporting, filtering, and alerting, specifically if the ScreenConnect agent, or any other agent, is outdated, potentially vulnerable, or unrecognized as legitimate. By utilizing this script, IT professionals can take a proactive stance in maintaining network security and ensuring the integrity of their own remote access tools.

The script to detect remote control software can be downloaded using the provided link or direct from our GitHub repository.

* Note: If you use the remote-control agent search script outside of Action1, by default the Action1 agent is excluded, but this is an easy edit to make the script detect it as well, just remove action1_agent.exe from the $ignore array variable.

How to Scan Systems for Indicators of ScreenConnect Compromise

This script developed by Action1, is designed to alert administrators to potential unauthorized access and malicious use of their hosts. BitDefender reported that systems that had been compromised using CVE-2024-1708 and CVE-2024-1709, would leave behind malicious files in the ScreenConnect extension directory to maintain persistence. The following script monitors that directory for signs of change. Note there may or may not be files already present in this directory for your implementation, this script is designed to keep record of what those files are and when last modified, so you can set up alerts detecting unexpected or unauthorized edits, creations, or deletions from this directory. Also note this script does not detect any malicious code indicators outright, so presence of files here should be investigated for legitimacy, and absence of files here only indicates this host was not compromised in this commonly reported way.
The script to detect CVE-2024-1708 & CVE-2024-1709 IOC can be downloaded using the provided link, or direct from our GitHub repository.

Using these scripts in Action1

Log in to the Action1 Platform or sign up for an account, the first 100 endpoints are free with no feature limitations.

Setup in minutes to reduce your cyber risks and costs:

No credit card. 100 endpoints free. No feature limits.

Then follow the instructions below for adding new data sources and reports to the system.

1. Click to create a new data source or follow these steps:

    • Go to Configuration | Data Sources, click [+New]
    • Enter data source name, such as ‘Remote Control Tools’, [Next]
    • Copy and paste the script above, [Next]
    • Run on a test endpoint*, [Finish]

    *This step WILL run the script on the endpoint, so ensure whatever system is being tested on has a proper backup recovery procedure.

2. Click to create a new report based on the new data source or:

    • Go to Real-time Reports & Alerts | Custom Reports, click +Add
    • Select your new data source (e.g. ‘Remote Control Tools’)
    • Enter report name, such as ‘Remote Control Tools’, [Next].
    • Choose [Simple Report]
    • Click [Add Columns] and add all columns, [Next], [Finish]

For more insights and updates, keep an eye on our blog and join our upcoming webinars.

See What You Can Do with Action1

 

Join our weekly LIVE demo “Patch Management That Just Works with Action1” to learn more

about Action1 features and use cases for your IT needs.

 

spiceworks logo
getapp logo review
software advice review
trustradius
g2 review
spiceworks logo

Related Posts

What is Endpoint Management?

Endpoint management is an essential part of modern and advanced IT security and device administration, providing every organization with the ability to identify, monitor, manage,...

read more