CVE-2024-1708

CVE-2024-1708 is a high-severity path traversal vulnerability that was discovered in ConnectWise's ScreenConnect software. This flaw, which affects versions 23.9.7 and earlier, allows a remote privileged user to read arbitrary files on the system using a specially crafted HTTP request. ConnectWise disclosed this vulnerability, along with an authentication bypass issue (CVE-2024-1709), on February 19, 2024, highlighting the potential for full system compromise if these vulnerabilities are exploited. Shortly after the disclosure, cybercriminals began actively exploiting these vulnerabilities, particularly CVE-2024-1708, to deliver ransomware attacks. Notably, Sophos' threat response task force reported observing several LockBit attacks within 24 hours of the disclosure, apparently exploiting the newly revealed ScreenConnect vulnerabilities. These attacks were also linked to certain IP addresses that were observed trying to exploit the same vulnerabilities in February 2024. The exploitation of these vulnerabilities poses serious security risks, especially as they have been used by various initial access brokers and threat groups to deliver ransomware. The first flaw, CVE-2024-1708, is critical for its ability to bypass authentication, while the second flaw, a path traversal issue (CVE-2024-1709), is high-severity due to its potential for lateral movement within systems, potentially compromising critical systems and data. Protection against these threats is provided by Check Point IPS blade.