id: CVE-2024-1708

info:
  name: "ConnectWise ScreenConnect - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an
    attacker the ability to execute remote code or directly impact confidential data or critical systems.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-1708&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=connectwise&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 8.4
    cve-id: CVE-2024-1708
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2024,connectwise,screenconnect,lfi,kev,vkev
http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(header, "ScreenConnect/")
          - compare_versions(version, '<= 23.9.7')
        condition: and

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
        internal: true

      - type: regex
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'