Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 9.5.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Kaseya VSA on-premise server software (versions before 9.5.7) is affected. An unauthenticated attacker can obtain agent credentials from the publicly accessible download page and use them to get a session cookie, which can then be used to access services meant only for agents and carry out further attacks on the system and its managed clients.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 4
helpdesk.kaseya.com
secpod.com
Questions about CVE-2021-30116
What does this mean?
The flaw is a credentials leak and a business logic flaw in Kaseya VSA. The checked data gives no further technical detail, and the resolution is described as in progress.Source: csirt.divd.nl
Am I affected, and how do I check?
The advisory title lists Kaseya VSA up to v9.5.6, but the checked data has no product ranges or conditions to confirm this. Compare the installed VSA version with that range.Source: csirt.divd.nl
What should I do about it?
Upgrade to 9.5.7, the version listed as the fix, which resolves CVE-2021-30116 and CVE-2021-30119. The fix quote refers to SaaS, and the checked data gives no workaround.Source: csirt.divd.nl
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data