CVE-2021-30116: Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
First published: Fri Jul 09 2021(Updated: )
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kaseya Vsa Agent | <9.5.0.24 | |
| Kaseya Vsa Server | <9.5.7a | |
| Kaseya Virtual System/Server Administrator (VSA) | ||
| <9.5.0.24 | ||
| <9.5.7a |
Remedy
Upgrade to a version after 9.5.6
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
- https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
- https://nvd.nist.gov/vuln/detail/CVE-2021-30116
Frequently Asked Questions
What is CVE-2021-30116?
CVE-2021-30116 is a vulnerability in Kaseya Virtual System/Server Administrator (VSA) that allows credential disclosure, as exploited in the wild in July 2021.
How severe is CVE-2021-30116?
CVE-2021-30116 has a severity rating of 9.8 (Critical).
What software is affected by CVE-2021-30116?
Kaseya Virtual System/Server Administrator (VSA) versions up to 9.5.7a are affected by CVE-2021-30116.
How can I fix the CVE-2021-30116 vulnerability?
To fix the CVE-2021-30116 vulnerability, it is recommended to update Kaseya VSA to version 9.5.7a or above.
Where can I find more information about CVE-2021-30116?
You can find more information about CVE-2021-30116 at the following references: [CSIRT DIVD](https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/), [Kaseya Helpdesk](https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021).
- agent/type
- agent/author
- agent/first-publish-date
- agent/description
- agent/severity
- agent/remedy
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/tags
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- vendor/kaseya
- canonical/kaseya vsa agent
- canonical/kaseya vsa server
- canonical/kaseya virtual system/server administrator (vsa)