Teardown: Explaining the ScreenConnect "SlashAndGrab" Flaw (Huntress)

This is the first post in a monthly series. Each month I pick one strong security blog post and walk through what works and what I'd change. I only pick posts I respect. I'm not trying to score them. I want to leave notes that people who write security content can use on Monday. I'm not affiliated with Huntress, and they didn't ask for this. This month's post is Huntress's plain-English explainer of SlashAndGrab, the ConnectWise ScreenConnect authentication bypass from February 2024. Huntress named the flaw, reproduced it fast and wrote several posts about it. This one is for the non-researchers: MSP owners, IT leads, executives. I read it the way that buyer would.

What works

1. It opens with a verdict, not a definition. The first line calls the exploit "trivial and embarrassingly easy." Many vulnerability posts open with a CVE number and a severity score. This one opens with how an admin should feel. The next paragraph backs it up with the CEO's quote from a TechCrunch headline. A line that quotable is rare. Leading with it was the right call.

2. It shows the mechanism instead of describing it. The breakdown takes three steps. Open the setup wizard page. Add a forward slash to the address. Create an admin account. A non-technical reader now knows why this scored a 10, and it took no jargon to get there. Then the post defines authentication bypass and path traversal in plain words. Most explainers lean on adjectives. This one shows the reader what happens.

3. The response story has numbers and candor. Huntress built a proof of concept in under two hours. It sent more than 1,600 incident reports to partners. It saw attackers using the flaw within 48 hours of a public proof of concept. The post explains why the team held back exploit details at first. Then a closing note admits some partners were still hit, and says why: not every partner had Huntress on every endpoint. That admission earns more trust than a claim of perfect coverage would.

What I'd change

1. Make every fact checkable. The byline is the company team, not a person. The page shows a last-updated date (August 3, 2024) but no publish date. The body gives the advisory date as February 19 with no year. A reader in 2026 can't tell whether this was written mid-response or months later. That matters, because people triage vulnerability content by date first. The post also says one of the two CVEs scored a 10, but not which one. (It's CVE-2024-1709, the authentication bypass. CVE-2024-1708, the path traversal, scored 8.4.) And the claim that thousands of servers were exposed needs a count, a source and a date, or a plain note that it's an estimate. Skeptical practitioners check these details before anything else. Each gap gives them a reason to doubt the rest.

2. Map the attacker activity to MITRE ATT&CK. The impact section lists ransomware, cryptominers and extra remote access, all in prose. A SOC lead reading it wants to hold that list against their own detections. A four-row table would let them:

Put it in a box at the end, so the plain-English tone stays intact for the main reader. The table also gives the Sigma rules Huntress contributed to SigmaHQ an obvious place in the story. Right now they get one sentence.

3. End with the reader's next step, not the vendor's. The page closes on a free-trial offer. A reader who runs ScreenConnect needs three things before that. Which version is safe (23.9.8 or later, though ConnectWise's bulletin also lists a patched build for customers off maintenance). How to check theirs. How to tell if they were already hit. Huntress published a compromise-check guide on February 23, 2024, but this page doesn't link to it. A three-line "If you run ScreenConnect" box near the top would fix all of this. The trial offer lands better once the reader has done the urgent thing.

A sharper opening

SlashAndGrab, Explained: How One Extra Slash Gave Attackers Admin on ScreenConnect

On February 19, 2024, ConnectWise warned that on-premises ScreenConnect servers older than version 23.9.8 had two flaws. The worse one, CVE-2024-1709, scored 10 out of 10. Here's why. Add one forward slash to the setup wizard's address, and the server lets anyone run setup again. That includes creating a new administrator account. Our researchers reproduced it in under two hours. Within 48 hours of a public proof of concept, attackers were using it to deploy ransomware and cryptominers and to plant more remote access. If you run ScreenConnect on-premises, upgrade to 23.9.8 or later now. Then check for signs of compromise.

Want this kind of read on your team's posts? Get a teardown of your own content.

Sources: SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained (Huntress). CVE scores and fixed versions: ConnectWise security bulletin, Feb 19, 2024. Compromise-check guide: Huntress, Feb 23, 2024. Technique names: MITRE ATT&CK.