ConnectWise Fixes XSS Vulnerability that Could Lead to Remote Code Execution

Distant monitoring and administration (RMM) platform ConnectWise has patched a cross-web site scripting (XSS) vulnerability that could guide to remote code execution (RCE).

Security scientists at Guardio Labs wrote about the flaw previously this week, stating menace actors could exploit it to consider comprehensive management of the ConnectWise platform.

“After testing and validating quite a few attack vectors, we have located that in the circumstance of the Webpage.Title source, the [user input validation] is not staying taken treatment of, leaving it susceptible to a ‘Stored XSS’ exploitation,” reads the Guardio Labs advisory.

“The user’s enter is inserted specifically, as is, in involving the tags on any webpage of the web application.”

The security enterprise also included that this bundled the landing web page for site visitors (where by they could enter their support code and potentially put in a remote obtain Trojan), the admin login page and any of the internal admin internet pages.

“Any code we maliciously inject in between the tags with some manipulations is executed as any other code in the context of the web application – as if it was authored by the formal proprietor of the service.”

Guardio Labs spelled out that a script executing from this context would give an attacker entire management about any element of the web app, potentially altering components on the site, as properly as relationship to the backend servers.

“This can harm any likely visitor [or] be used to abuse the hosting companies by itself – making it possible for misuse of ConnectWise hosting, identity, and certification to serve destructive code or achieve total access to admin webpages even just after the demo time period is in excess of,” reads the technological create-up.

Guardio Labs verified it disclosed the vulnerability previously this calendar year, which ConnectWise immediately patched on August 8, 2022, in v22.6.

“As asked for by ConnectWise, we waited at minimum 30 far more days ahead of this disclosure so on-prem customers will get the chance to update their installations as effectively,” clarified the firm.

The correct arrives months immediately after IBM found out an RCE vulnerability in Cobalt Strike deriving from an present and partly unpatched XSS flaw.

Some parts of this article are sourced from:
www.infosecurity-magazine.com