PRP: connectwise screenconnect authentication bypass

[JamesFoxxx]

Hi Hi, This is a request for implementing the recent screenconnect authentication bypass vulnerability. This is a critical vulnerability that lets attackers create administrator accounts and after that administrator can reach an RCE with the help of another vulnerability. The vulnerable versions are available for confirming the authentication. Can I Start writing a plugin for this now? best regards, James.

Ref:

• https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
• https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
• https://docs.connectwise.com/ConnectWise_ScreenConnect_Documentation/On-premises/Get_started_with_ConnectWise_ScreenConnect_On-Premise

[JamesFoxxx]

https://twitter.com/Shadowserver/status/1760740607268638809?s=19 Wow the number of vulnerable instances is significant. CC for @tooryx @maoning

[tooryx]

Hi @JamesFoxxx,

Thank you for willing to contribute to Tsunami. We are currently not interested in that specific CVE. Please, feel free to suggest other plugins if there is anything that you wish to work on.

~tooryx