CVE-2021-35066
📋 TL;DR
This CVE describes an XML External Entity (XXE) vulnerability in ConnectWise Automate that allows attackers to read arbitrary files from the server filesystem. It affects ConnectWise Automate installations before version 2021.0.6.132. Organizations using vulnerable versions of this remote monitoring and management software are at risk.
💻 Affected Systems
- ConnectWise Automate
📦 What is this software?
Automate by Connectwise
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to read sensitive files, potentially including configuration files with credentials, leading to lateral movement and full network access.
Likely Case
Unauthorized file disclosure including configuration files, logs, and potentially sensitive data stored on the server.
If Mitigated
Limited impact with proper network segmentation and file system permissions, though sensitive data exposure may still occur.
🎯 Exploit Status
XXE vulnerabilities typically have low exploitation complexity. While no public PoC exists, the vulnerability type is well-understood and likely weaponized in targeted attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.0.6.132 or later
Vendor Advisory: https://home.connectwise.com/securityBulletin/60cc8c63508a120001cb6e8d
Restart Required: Yes
Instructions:
1. Backup your ConnectWise Automate installation and database. 2. Download the latest patch from ConnectWise portal. 3. Run the installer with administrative privileges. 4. Restart the ConnectWise Automate services. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable XML external entity processing
allConfigure XML parsers to disable external entity resolution
Configuration depends on specific XML parser implementation. Consult ConnectWise documentation for parser-specific settings.
Network segmentation
allRestrict network access to ConnectWise Automate server
Implement firewall rules to limit inbound connections to trusted IP addresses only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the ConnectWise Automate interface
- Monitor file access logs for unusual read patterns and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check the ConnectWise Automate version in the web interface under Help > About, or examine the installed version in Programs and Features (Windows).Check Version:
In ConnectWise Automate web interface: Navigate to Help > About. On Windows server: Check Programs and Features or registry at HKEY_LOCAL_MACHINE\SOFTWARE\LabTech\InstallVerify Fix Applied:
Verify the version is 2021.0.6.132 or later in the web interface or installed programs list.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in application logs
- Multiple failed XML parsing attempts
- File read operations from unexpected processes
Network Indicators:
- XML payloads containing external entity references in HTTP requests
- Outbound connections from ConnectWise server to unexpected external IPs
SIEM Query:
source="connectwise-automate" AND (message="*XXE*" OR message="*external entity*" OR message="*DOCTYPE*")