CVE-2021-30116— Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-30116
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Source: NVD (National Vulnerability Database)
Vulnerability Description
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Kaseya VSA 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kaseya VSA是美国Kaseya公司的托管服务提供商 (MSP) 常用来管理客户网络的RMM（远程监控和管理）软件。 Kaseya VSA存在输入验证错误漏洞，该漏洞允许远程攻击者可利用该漏洞危及受影响的系统。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2021-30116
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30116.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-30116
请登录查看更多情报信息。
Same Patch Batch · n/a · 2021-07-09 · 49 CVEs total
| CVE-2021-30120 | 9.9 CRITICAL | 2FA bypass in Kaseya VSA <= v9.5.6 |
| CVE-2021-30118 | 9.8 CRITICAL | Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5 |
| CVE-2021-30117 | 9.8 CRITICAL | Authenticated SQL injection in Kaseya VSA < v9.5.6 |
| CVE-2021-23405 | 8.3 HIGH | SQL Injection |
| CVE-2021-30201 | 7.5 HIGH | Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6 |
| CVE-2021-30121 | 6.5 MEDIUM | (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6 |
| CVE-2021-30119 | 5.4 MEDIUM | Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 |
| CVE-2020-35986 | Rukovoditel 跨站脚本漏洞 | |
| CVE-2020-25875 | Codoforum 跨站脚本漏洞 | |
| CVE-2020-25392 | CSZ CMS 跨站脚本漏洞 | |
| CVE-2020-21333 | PublicCMS 跨站脚本漏洞 | |
| CVE-2020-35987 | Rukovoditel 跨站脚本漏洞 | |
| CVE-2021-35358 | Dotcms dotCMS 跨站脚本漏洞 | |
| CVE-2021-35361 | Dotcms dotCMS 跨站脚本漏洞 | |
| CVE-2021-35360 | Dotcms dotCMS 跨站脚本漏洞 | |
| CVE-2021-36371 | Emissary-Ingress 信任管理问题漏洞 | |
| CVE-2021-33214 | Hms Networks eCatcher 安全漏洞 | |
| CVE-2021-33792 | Foxit Reader 和 Foxit PhantomPDF 缓冲区错误漏洞 | |
| CVE-2021-33795 | Foxit Reader和Foxit PhantomPDF 安全漏洞 | |
| CVE-2021-27038 | Autodesk Design Review 安全漏洞 |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-30116
No comments yet