Kaseya · Virtual System/Server Administrator (VSA)
Kaseya Virtual System/Server Administrator (VSA) before 9.5.7 contains an information disclosure flaw in its default, unauthenticated client download page (/dl.asp), which exposes agent credentials. An attacker needs only network access to the VSA server and no authentication or user interaction: they can download and install the Windows client, read the resulting KaseyaD.ini file to obtain the agent GUID and password, and use those credentials at /dl.asp to obtain a session cookie for further attacks against the system.
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
First seen exploited 7 days before it was disclosed.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
unauthenticated public-facing web page exposes credentials
The default URL for this page is https://x.x.x.x/dl.asp
agent credentials stored in readable config file
KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-30116 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116Footnote 4 and CVE-2021-30120,Footnote 5 which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.Footnote 6…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.