CVE-2021-30116
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
In short
Kaseya VSA before version 9.5.7 has a critical flaw where an unauthenticated attacker can download client software, extract embedded credentials from it, and use those credentials to gain authenticated access to the system and bypass security controls. This allows attackers to take full control of the software and all connected client computers.
Technical detail
The vulnerability exists in the unauthenticated /dl.asp download page which distributes client installers containing hardcoded Agent_GUID and AgentPassword credentials in the KaseyaD.ini configuration file. An attacker can extract these credentials, submit them via GET request to /dl.asp to obtain a valid sessionId cookie, and use this cookie to authenticate to administrative functions not intended for agent access, leading to complete system compromise without requiring legitimate credentials.
Summary generated and translated by AI from the official description.
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H