PT-2020-9833 · Connectwise · Connectwise Control

Matt Hamilton · Published 2020-01-23 · Updated 2020-01-28 · CVE-2019-16517

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185

Description A CORS misconfiguration issue allows JavaScript running on any domain to interact with the server APIs, enabling administrative actions without the victim's knowledge. This is due to the server reflecting the Origin provided by incoming requests.

Recommendations For ConnectWise Control version 19.3.25270.7185, consider restricting access to the server APIs to prevent unauthorized administrative actions until a fix is available. As a temporary workaround, review and adjust the CORS configuration to properly validate and handle incoming requests.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2019-16517

Affected Products

Connectwise Control

References · 7

• 🔥 https://know.bishopfox.com/advisories/connectwise-control · Exploit
• 🔥 https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16517 · Security Note
• https://know.bishopfox.com/advisories · Note
• https://crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox · Note
• https://crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox · Note