erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: February 19, 2024

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: SlashAndGrab. Anyone running a self-hosted ScreenConnect server on version 23.9.7 or earlier, especially if it is reachable from the internet.
  • Composer (PHP): 1 critical advisory (torrentpier/torrentpier). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-1709, CVE-2024-1708

ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)

Any on-premises ScreenConnect server still below 23.9.8 should be treated as compromised until proven otherwise; cloud-hosted customers were patched by ConnectWise.

Must act: Anyone running a self-hosted ScreenConnect server on version 23.9.7 or earlier, especially if it is reachable from the internet.

Can relax: ConnectWise cloud-hosted customers and anyone already on 23.9.8 or later who has checked for signs of compromise.

  1. Check the ScreenConnect server version and upgrade on-premises servers to 23.9.8 or later (or 22.4.20001 if off maintenance).
  2. Before returning a server to service, check IIS logs, the user list and App_Extensions for signs of compromise.
  3. Remove unrecognized accounts, reset all ScreenConnect passwords and enable MFA.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit