Kaseya VSA before 9.5.7 enforces its two-factor authentication requirement on the client side, allowing the MFA check to be bypassed. An attacker with network access and a valid username and password can use an intercepting proxy to flip the server's MFARequired response from True to False, which skips the second-factor prompt and logs them in.
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
First seen exploited 3 days before it was disclosed.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2021-30120 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116Footnote 4 and CVE-2021-30120,Footnote 5 which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.Footnote 6…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.