# Validating the Bishop Fox Findings in ConnectWise Control

Stored XSS in ConnectWise Control's Appearance modifier lets any trial customer run arbitrary JavaScript in visitors' browsers on a *.screenconnect.com domain.

- Payout: Research
- Severity: high
- Program: ConnectWise
- Write-up by: Huntress
- Disclosed: 2020-01-22
- CVE: CVE-2019-16512, CVE-2019-16513, CVE-2019-16514, CVE-2019-16515, CVE-2019-16516, CVE-2019-16517
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/validating-the-bishop-fox-findings-in-connectwise-control
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-bishop-fox-findings-in-connectwise-control
- Tags: area:web domain:web impact:integrity kind:research platform:threat-intel sev:high technique:source-review vuln:xss

**Target:** Appearance customization feature of the Control web app
**Root cause:** The Appearance modifier accepts customer-supplied HTML/script content that is stored and rendered to other visitors without effective script filtering.
**Steps:**
1. Register a trial ConnectWise Control instance on *.screenconnect.com
2. Use the Appearance modifier feature to store HTML containing script tags
3. Lure an authenticated user to view the customized instance page
4. Script executes in the victim's browser origin
**How found:** Bishop Fox reviewed the legitimate Appearance customization feature and tested whether stored markup was sanitized, confirming script execution.
**Exploitation:** A malicious customer registers a trial, stores JavaScript via the Appearance modifier, and serves it from a *.screenconnect.com domain to any visitor, executing in their browser; could serve as a building block for further attack chains.
**Insight:** Legitimate white-label/customization features that render customer HTML are prime stored-XSS surfaces; trial accounts on shared parent domains let attackers host payloads on trusted origins.