GoKawiilConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week.
ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance.
The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking.
"ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions," the company said in a security advisory issued on Thursday.
While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks.
This requires IT administrators to go through the following steps:
Log in to the ScreenConnect Administration page. Go to Administration > Security > Roles. Edit user roles and check session groups (in bold)with permissions assigned to them. In the Scoped Permissions window, deselect the TransferFiles permission (or TransferFilesInSession for legacy) for each session group. Save changes and repeat for all roles.
Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured.
Internet-exposed ScreenConnect instances (Shadowserver)
ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups.
... continue reading