A cross-site scripting (XSS) vulnerability in ConnectWise Control, the remote monitoring and management (RMM) platform, offered attackers a powerful attack vector for abusing remote access tools.
Now patched, the stored XSS flaw was disclosed by Guardio Labs, which in July published an analysis of tech support scams, a widespread phenomenon whereby scammers abuse RMM platforms in order to create fake technical support portals and dupe victims into inadvertently installing malware.
Once installed, a remote access tool gives attackers remote control of a victim’s desktop PC or mobile device and, said the report, “is persistent, mostly undetectable, and bypasses almost all regular forms of protection. And in a show of supreme chutzpah, these scammers even manipulate this capability to bypass 2FA protection and take full control of PayPal and bank accounts”.
A new technical write-up documenting the ConnectWise XSS explains how attackers could easily register for a free, anonymous email account and submit fake personal details. This would give them a corporate-grade remote access agent and support portal they could customize – with no coding skills needed – to convincingly mimic famous brands.
Scammers could then call and dupe victims by, for example, sending “them a fake invoice for some service they never registered to, urgently referring them to a […] fake refund service portal to enter the ‘invoice’ code (triggering the dedicated silent [remote access tool] installation),” wrote Nati Tal, head of Guardio Labs.
Full control
The stored XSS bug arose from a lack of sanitation of the Page.Title resource. “Any code we maliciously inject in between the
tags with some manipulations is executed as any other code in the context of the webapp – as if was authored by the official owner of the service,” explains Tal.
<p>“A script executing from this context gives an attacker full control over any element of the webapp, potentially altering any element of the page as well as connection to the backend servers,” contined Tal.</p>
<p>Scammers could also “abuse the hosting service itself – allowing misuse of ConnectWise hosting, identity, and certificate to serve malicious code or gain full access to admin pages even after the trial period is over.”</p>
<h3 class="wp-block-heading">‘Bold move’</h3>
<p>ConnectWise recently added a prominent advisory to its remote support service to alert visitors to this <a href="https://portswigger.net/daily-swig/social-engineering" target="_blank" rel="noreferrer noopener">social engineering</a> threat. However, Guardio Labs found that attackers could also execute code that removes this warning.</p>
<p>ConnectWise has since responded by removing the customization feature for trial accounts – “a bold move” that would prevent scammers from creating credible-looking Amazon or Microsoft support pages but at the cost of losing a useful feature and commercial differentiator, noted Tal. “They sure took this matter seriously which is very appreciated and will surely help make web browsing safer and the scammers’ life a bit harder,” he said.</p>
<p>“ConnectWise was very responsive and quickly fixed the issue” by adding sanitization to Page.Title that neutralized Guardio’s exploit code, added the researcher.</p>
<p>Users are advised to update to version v22.6, released on August 8, 2022, or later.</p>
<p id="block-79eca6bd-8f08-47c3-b363-b92b296b7d27">Copyright 2021 Associated Press. All rights reserved.</p>
<p id="block-583eb7f7-060a-4183-b429-2f2a25a89f0e">Source: <a href="https://portswigger.net/daily-swig/connectwise-closes-xss-vector-for-remote-hijack-scams" target="_blank" rel="noreferrer noopener">https://portswigger.net/daily-swig/connectwise-closes-xss-vector-for-remote-hijack-scams</a></p>
