We certainly did.”ĬonnectWise in a statement provided to CRN said that both it and Bishop Fox “agreed that no active exploits had occurred from these potential vulnerabilities.”

That doesn’t mean we didn’t take them seriously. “They provided conceptual ideas of how they might be exploited, but they wouldn’t or couldn’t provide us with any specific examples. “The vulnerabilities they reported to us didn’t really provide a proof of exploitation,” he said. If RMM tools are not architected or configured properly, MSPs can expose themselves and their customers to a “whole bunch of different security concerns,” said Wood.ĬonnectWise Director of Security Tom Greco Tuesday told CRN that ConnectWise’s engineers have patched 75 percent of the flaws that Bishop Fox identified, despite its difficulty in reproducing them.

The “attack chaining” can result in either “forgery vulnerabilities” on the ConnectWise Control server or a client desktop breach that opens the door to the “endpoint” device itself, according to Bishop Fox, which bills itself as the largest private services firm focused on “offensive security testing.”ĬonnectWise Control is among the most popular MSP tools, with at least 100,000 users managing millions of endpoints around the globe, according to ConnectWise.īishop Fox indicated that it is also looking for potential security flaws in other remote monitoring and management tools for MSPs. We call them basically attack chaining,” said Wood. “The flaws in general, they’re serious in their own right, but when you start taking a look at chaining the vulnerabilities together.

The eight flaws named by Bishop Fox are: cross-site scripting, CORS (Cross-Origin Resource Sharing) misconfiguration, cross-site request forgery, information disclosure, remote code execution, user enumeration, missing security headers and insecure cookie scope. He deemed them severe enough to rate them as critical, and the attack chain so bad that we had to report them,” Bishop Fox Associate Vice President of Consulting Daniel Wood told CRN.Ĭhaining the vulnerabilities “would allow an attacker to execute arbitrary code on a victim’s Control server, as well as gain control of any client machines connected to a victim’s Control instance,” according to a post from Bishop Fox on what it calls the ConnectWise Critical (Zero-Day) Vulnerability Disclosure.

“One of our security researchers found these vulnerabilities. Using multiple security flaws in ConnectWise Control, hackers could create an “attack chain” that gives cyber-criminals the ability to hijack an MSP’s systems as well as their customers’ devices, security consultant Bishop Fox plans to announce Wednesday.

Connectwise desktop client