CVE-2024-1708 | Detection.FYI

CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Jan 6, 2025 · attack.persistence cve.2024-1708 ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security

Jan 6, 2025 · attack.initial-access attack.persistence cve.2024-1708 ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More