CVE-2023-25718: 
NixOS vulnerability analysis and mitigation

** DISPUTED ** In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), a reported vulnerability involved the ability to add additional instructions to a signed executable file without invalidating the signature. The issue was reported in February 2023, affecting ConnectWise Control installations. ConnectWise's position is that this purported vulnerability represents a 'fundamental lack of understanding of Authenticode code signing behavior.' (MITRE CVE)

The reported issue involved URL parameters 'h' (host) and 'p' (port) in downloading a Control client that could be manipulated to point the connection to another endpoint prior to version 22.8. ConnectWise addressed this in Control version 22.8.10013 with 'additional validation of client installer URL parameters to inhibit certain social engineering attacks.' The vendor maintains that this is not a true vulnerability but rather a misunderstanding of how Authenticode code signing works. (Huntress Blog)

The potential impact was initially reported as allowing an attacker to offer end users a different attacker-controlled executable file. However, this claim was disputed as it still required user interaction and social engineering to be effective. The actual impact was limited to potential social engineering scenarios rather than a true security vulnerability. (ConnectWise Blog)

ConnectWise released version 22.8.10013 and later 22.9.10032 to address the URL parameter manipulation concern. For on-premises installations, administrators are recommended to configure WebServerAddressableUrl and RelayAddressableUrl to prevent proxying techniques. All cloud instances have been updated to remediate this issue. (Huntress Blog)

The security community, including Huntress researchers, has largely disagreed with the severity of the reported vulnerability. The consensus is that the claims were overblown and that the core issue still relies on social engineering rather than a true security vulnerability. The vendor's response and mitigation efforts were deemed appropriate for the actual risk level. (Huntress Blog)