29:null 2a:["$","title",null,{"children":"ConnectWise ScreenConnect | Coalition Research's Workspace | Observable"}] 2f:T5b6,

${formatPercent(data_cve_2024_1709['cess_exploit_availability_predictions']?.[data_cve_2024_1709['cess_exploit_availability_predictions']?.length - 1]?.['score'])}

CESS Exploit Availability

${formatPercent(data_cve_2024_1709['cess_exploit_usage_predictions']?.[data_cve_2024_1709['cess_exploit_usage_predictions']?.length - 1]?.['score'])}

CESS Exploit Usage

${formatPercent(data_cve_2024_1709['epss_scores']?.[data_cve_2024_1709['epss_scores']?.length - 1]?.['score'])}

EPSS

${data_cve_2024_1709['cvss_scores']?.[data_cve_2024_1709['cvss_scores']?.length - 1]?.['score']}

CVSS

30:T5b6,

${formatPercent(data_cve_2024_1708['cess_exploit_availability_predictions']?.[data_cve_2024_1708['cess_exploit_availability_predictions']?.length - 1]?.['score'])}

CESS Exploit Availability

${formatPercent(data_cve_2024_1708['cess_exploit_usage_predictions']?.[data_cve_2024_1708['cess_exploit_usage_predictions']?.length - 1]?.['score'])}

CESS Exploit Usage

${formatPercent(data_cve_2024_1708['epss_scores']?.[data_cve_2024_1708['epss_scores']?.length - 1]?.['score'])}

EPSS

${data_cve_2024_1708['cvss_scores']?.[data_cve_2024_1708['cvss_scores']?.length - 1]?.['score']}

CVSS

31:T4fc,chart = { const svg = d3.create("svg") .attr("viewBox", [0, 0, 1000, 300]); const bar = svg.append("g") .attr("fill", "steelblue") .selectAll("rect") .data(data) .join("rect") .style("mix-blend-mode", "multiply") .attr("x", d => x(d.name)) .attr("y", d => y(d.value)) .attr("height", d => y(0) - y(d.value)) .attr("width", x.bandwidth()); const gx = svg.append("g") .call(xAxis); const gy = svg.append("g") .call(yAxis); return Object.assign(svg.node(), { update(order) { x.domain(data.sort(order).map(d => d.name)); const t = svg.transition() .duration(750); bar.data(data, d => d.name) .order() .transition(t) .delay((d, i) => i * 20) .attr("x", d => x(d.name)); gx.selectAll("text") .style("font-size", "7px"); // You can change '10px' to any other size that fits your needs gx.transition(t) .call(xAxis) .selectAll("text") .attr("transform", "rotate(90)") .attr("y", 0) .attr("x", 9) .attr("dy", ".35em") .style("text-anchor", "start") .selectAll(".tick") .delay((d, i) => i * 20); } }); } 32:[{"id":"f8e82922261ff5a1fe05c353f053703dd14a3a16ae2286b89742cb2093baa56bfcf381457ff9f514634319e1ac48b87f8ac582842e25f6f0f9e28561f0b65e5b","href":"https://static.observableusercontent.com/files/f8e82922261ff5a1fe05c353f053703dd14a3a16ae2286b89742cb2093baa56bfcf381457ff9f514634319e1ac48b87f8ac582842e25f6f0f9e28561f0b65e5b","name":"bq-screenconnect-2024-01-01-to-2024-02-23.csv","type":"text/csv","lastModified":1708700048745.983,"size":82},{"id":"a9f6951849dc84661ed49c0440050be3977ed0cd59dd7d323b7fbe60e339219a271a2fddf79bc1d574aded8a7b7e1b9b5b6a91649bceba1c9094d19542485c58","href":"https://static.observableusercontent.com/files/a9f6951849dc84661ed49c0440050be3977ed0cd59dd7d323b7fbe60e339219a271a2fddf79bc1d574aded8a7b7e1b9b5b6a91649bceba1c9094d19542485c58","name":"bq-screenconnect-firehose-versions-2024.json","type":"application/json","lastModified":1708708559700.968,"size":4072},{"id":"a96240f9a0281c820ac8eb0356b73918c95f4a0ef2a1f4d6db4c6a91c2bb11bb1490da1ddb8f68e438ae61db73720518c05e638d665eed90e51bcfe4219da913","href":"https://static.observableusercontent.com/files/a96240f9a0281c820ac8eb0356b73918c95f4a0ef2a1f4d6db4c6a91c2bb11bb1490da1ddb8f68e438ae61db73720518c05e638d665eed90e51bcfe4219da913","name":"bq-screenconnect-firehose-all-versions-by-quarter@1.json","type":"application/json","lastModified":1708714665624.894,"size":673},{"id":"39e6dc1f1988130d39c95642e7959ca2545496ba858596ea3f19c056a027eea7bb6eef6f8657e095d9761399af6be383f43815a6afd0971cf0e65aa888f8eda0","href":"https://static.observableusercontent.com/files/39e6dc1f1988130d39c95642e7959ca2545496ba858596ea3f19c056a027eea7bb6eef6f8657e095d9761399af6be383f43815a6afd0971cf0e65aa888f8eda0","name":"bq-screenconnect-2024-02-01-to-2024-02-26.csv","type":"text/csv","lastModified":1708966076100.802,"size":138},{"id":"061951a7029840895804a60ab531c4525b87468cde10dfd57b9ae7ce348949a0e961ee25af0aa8879f706ceb3019b7d02ff8b042dfa72fbd12d18d4224d4c5e8","href":"https://static.observableusercontent.com/files/061951a7029840895804a60ab531c4525b87468cde10dfd57b9ae7ce348949a0e961ee25af0aa8879f706ceb3019b7d02ff8b042dfa72fbd12d18d4224d4c5e8","name":"bq-screenconnect-2024-01-01-to-2024-02-29.csv","type":"text/csv","lastModified":1709290712635.311,"size":195}] 2d:{"id":"fb57471ef7336bd1","slug":"connectwise-screenconnect","title":"ConnectWise ScreenConnect","thumbnail":"e1965ae1bb420cd8362ce1e6f7d3f17db3b6a29bc8f0eb9498ebf2835e42a6f0","access_level":"public","create_time":"$D2024-02-22T22:39:00.626Z","update_time":"$D2024-04-29T11:45:20.128Z","view_time":null,"first_public_time":"$D2024-02-24T00:30:07.371Z","has_unpublished_edits":null,"fork":false,"stars":0,"starred":false,"owner":{"type":"team","id":"5ec40b2e0ec46003","login":"coalition-research-ws","name":"Coalition Research's Workspace","avatar_url":"https://avatars-next.observableusercontent.com/3b1325f1169c0e8de44164dc94d1939f5ad283e167296e044081e2dd9c0b41c7","tier":"starter_2024"},"version":503,"publish_version":null,"role":null,"authored":false,"authors":[{"type":"individual","id":"399376b5ec6d3fad","login":"coalition-research","name":"Coalition Research","avatar_url":"https://avatars-next.observableusercontent.com/652745f40b1c829228148400a46263cdda4fc70addd5a4e7e92004d7298afe17","tier":null}],"members":[{"type":"individual","id":"399376b5ec6d3fad","login":"coalition-research","name":"Coalition Research","avatar_url":"https://avatars-next.observableusercontent.com/652745f40b1c829228148400a46263cdda4fc70addd5a4e7e92004d7298afe17","tier":null,"role":"editor"},{"type":"team","id":"5ec40b2e0ec46003","login":"coalition-research-ws","name":"Coalition Research's Workspace","avatar_url":"https://avatars-next.observableusercontent.com/3b1325f1169c0e8de44164dc94d1939f5ad283e167296e044081e2dd9c0b41c7","tier":"starter_2024","role":"editor"}],"comments":[],"custom_thumbnail":true,"trashed":false,"lapsed":null,"subscribed":null,"forks":0,"collection":null,"type":"notebook","body":{"title":"ConnectWise ScreenConnect","cells":[{"id":228,"value":"# ConnectWise ScreenConnect\n","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":226,"value":"toc()","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":0,"value":"Coalition Security Labs, our security research and innovation center, has been monitoring a critical vulnerability which affects ConnectWise ScreenConnect versions up to and including 23.9.7. Following ConnectWise's [public disclosure](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8) of the vulnerability on February 19, 2024, we began gathering information to notify impacted policyholders and update our honeypots.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":90,"value":"# What is ScreenConnect?\n

ScreenConnect is a popular remote desktop tool that provides both self-hosted and cloud solutions. ConnectWise confirmed in its public disclosure of the vulnerabilities that it has patched the cloud solution of ScreenConnect. However, self-hosted users must update their servers to protect against the culnerability.

","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":93,"value":"# What are the Vulnerabilities?\n\nThere are 2 vulnerabilities: an authentication bypass (CVE-2024-1709) with CVSS 10.0 and a path traversal (CVE-2024-1708) with CVSS 8.4, both published on NVD on February 21. ","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":121,"value":"

CVE-2024-1709

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

CWE-288: Authentication bypass using an alternate path or channel.

More information about CVE-2024-1709 is on our Exploit Scoring System page, summarized below:

","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":377,"value":"$2f","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":113,"value":"

CVE-2024-1708

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

CWE-22: Improper limitation of a pathname to a restricted directory (“path traversal”).

More information about CVE-2024-1708 is on our Exploit Scoring System page, summarized below:

","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":458,"value":"$30","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":209,"value":"## Authentication Bypass\nThe authentication bypass is caused by an attacker being able to access and run the initial setup wizard -- a critical component of ScreenConnect that should only run once when the software is initially deployed. Accessing the setup wizard post-deployment gives attackers the ability to set the admin username and password.\n\nIn a technical deep dive, [Horizon3](https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/?utm_source=twitter&utm_medium=social&utm_campaign=connectwise&utm_content=blog) explains how the authentication bypass attack works. Essentially, a critical HTTP filter should block requests to `SetupWizard.aspx` after the server has been deployed. However, the filter uses an exact string match, which means a request to the URL `SetupWizard.aspx` would be filtered -- but simply adding a forward slash to the end of the request (`SetupWizard.aspx/`) would bypass the filter. Once inside, attackers have full control over the server.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":88,"value":"# Indicators of Compromise (IOC)\n\nThere are 2 main indicators of compromise for the ScreenConnect vulnerabilities. The first is to look for logs accessing `SetupWizard.aspx/`. The second is to look at the application's Tools -> Audit page to see a list of recent login attempts per IP address. ","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":25,"value":"# Honeypot Observations\n\nUsing our network of global honeypots, we focus on events that target `/SetupWizard.aspx`, as either `GET` or `POST` requests. There were no prior events in 2024 until the first events started to appear on February 21 (the same day the public exploits were released). Between February 21 and February 29, we observed a total of 21,486 events, which came from 244 unique IP addresses.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":323,"value":"bqScreenconnect20240101To20240229 = await FileAttachment(\"bq-screenconnect-2024-01-01-to-2024-02-29.csv\").csv({typed: \"auto\"})","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"bqScreenconnect20240101To20240229","database":"$undefined"},{"id":49,"value":"Plot.plot({\n marks: [\n Plot.lineY(bqScreenconnect20240101To20240229, {x: \"event_date\", y: \"total_events\", tip: true}),\n Plot.lineY(bqScreenconnect20240101To20240229, {x: \"event_date\", y: \"unique_ips\", tip: true}),\n Plot.ruleY([0])\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":76,"value":"# Scanning Observations","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":246,"value":"Next, we turn to our internet-wide scanning data to understand the deployment of different versions of ScreenConnect. Looking at data from Q1, 2024, we see the most popular version is 23.8.6 with 1,366 deployments; followed by version 23.8.5 with 742 deployments; and 23.2.9 with 162 deployments.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":164,"value":"viewof order = {\n const options = [\n {label: \"Alphabetical\", value: (a, b) => a.name.localeCompare(b.name)},\n {label: \"Frequency, ascending\", value: (a, b) => a.value - b.value},\n {label: \"Frequency, descending\", value: (a, b) => b.value - a.value}\n ];\n const form = html`