# ConnectWise ScreenConnect CVE-2024-1709 & CVE-2024-1708

ScreenConnect's setup wizard path check was bypassable via a trailing path segment, letting unauthenticated attackers create an admin user and achieve RCE.

- Payout: Research
- Severity: critical
- Program: ConnectWise ScreenConnect
- Credited: Huntress
- Disclosed: 2024-02-21
- CVE: CVE-2024-1709, CVE-2024-1708
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- Tags: domain:web impact:privesc impact:rce kind:research platform:threat-intel sev:critical tech:dotnet technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:file-upload vuln:path-traversal

**Target:** On-premise ScreenConnect web application (SetupWizard.aspx, extension upload)
**Root cause:** SetupModule compared Request.Path to "/SetupWizard.aspx" exactly, but .NET appends PathInfo to Request.Path, so "/SetupWizard.aspx/anything" failed the equality check and was treated as unconfigured, exposing the setup wizard.
**Steps:**
1. Diff patched 23.9.8 vs unpatched 23.9.7; note SetupWizard.aspx and SetupModule handler registration changes
2. Observe new ISetupHandler check replacing Request.Path string comparison
3. Request `GET /SetupWizard.aspx/literallyanything` on a configured instance
4. Setup wizard loads; submit new admin credentials, overwriting the internal user database
5. Log in as admin and upload a malicious ScreenConnect extension executing .NET code as SYSTEM
**How found:** Team built local environments of patched and unpatched versions and diffed files; SetupWizard.aspx text diff revealed a new setup-state check, prompting decompilation of ScreenConnect.SetupModule, where the handler-registration change and Request.Path comparison hinted that path suffix tricks could bypass the check.
**Exploitation:** Unauthenticated attacker hits `/SetupWizard.aspx/<anything>` to reach the setup wizard, creates a new admin user (wiping existing local users), then uses the legitimate Extensions feature to upload a .NET extension that runs as SYSTEM, yielding RCE.
**Escalation:** Auth bypass unlocks admin panel, whose extension-upload feature is repurposed for RCE; CVE-2024-1708 ZipSlip in extension extraction allows writing .aspx/.ashx into App_Extensions root for stealthier execution without an installed extension.
**Insight:** When a patch swaps a Request.Path string comparison for a resolved-handler check, suspect .NET path-suffix tricks: Request.Path includes PathInfo, so appending `/anything` to a protected .aspx bypasses equality checks while still routing to the handler.