# Overblown Claims of Vulnerabilities, Exploits, & Severity

Host header tampering on on-prem ConnectWise Control client downloads lets a signed installer fetch and run an attacker-staged ClickOnce app, achieving code execution via social engineering.

- Payout: Research
- Severity: medium
- Program: ConnectWise Control
- Credited: Huntress
- Disclosed: 2022-12-14
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity
- Tags: domain:web impact:rce kind:research platform:threat-intel sev:medium tech:dotnet technique:chained technique:source-review vuln:host-header vuln:rce

**Target:** On-premises ConnectWise Control server client-download endpoint
**Root cause:** The client-download flow trusts the attacker-controlled Host header to build the URL from which the signed installer fetches its ClickOnce .application payload, and post-signing configuration can be altered without invalidating the signature.
**Steps:**
1. Request the Control client installer with a modified `Host:` header pointing to an attacker-controlled server.
2. Observe error logs showing the signed installer reaches out to the supplied Host to download a `.application` ClickOnce file.
3. Stage an endpoint serving a malicious ClickOnce `.application` (e.g. C# reverse shell stub).
4. Deliver the signed installer to the victim; on run it downloads and installs the staged ClickOnce app, spawning a new process.
**How found:** Huntress followed the researcher's screenshots of Host header manipulation, noticed the installer failed to retrieve data, hypothesized that staging an endpoint serving the expected .application file would let them control what gets installed, and confirmed via error logs and a calculator/reverse-shell PoC.
**Exploitation:** Attacker stages a ClickOnce .application on their own host, tampers the Host header when fetching the signed ConnectWise installer so it points at that host, then delivers the signed binary (email attachment, drive-by download, or XSS-forced request). Victim runs it, approves the ClickOnce prompt, and attacker code executes as a separate process.
**Escalation:** Chained with XSS/drive-by-download or email attachment to deliver the binary; relies on the legitimate signature to bypass AV/endpoint trust.
**Insight:** When a signed installer fetches secondary payloads from a URL derived from request headers, stage the expected file type (here ClickOnce .application) at a controlled host and tamper the Host header — the signature stays valid while you control the installed code.