CVE-2021-30116 in Virtual System Administrator
Summary
by MITRE • 07/09/2021
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2024
The vulnerability described in CVE-2021-30116 represents a critical authentication bypass flaw in Kaseya VSA versions prior to 9.5.7, demonstrating how default configuration issues can lead to complete system compromise. This vulnerability operates through a chain of credential exposure and authentication bypass mechanisms that exploit the software's default download page functionality. The attack begins with an unauthenticated access point at the default URL https://x.x.x.x/dl.asp which serves as the primary entry point for malicious actors seeking to compromise the system. This initial exposure occurs because the download page does not require authentication, creating an attack surface that allows unauthorized users to obtain critical system information.
The technical flaw stems from the improper handling of credential information within the Kaseya VSA architecture, specifically within the agent installation process. When Windows clients download and install the Kaseya agent software, the system automatically generates a configuration file named KaseyaD.ini at C:\Program Files (x86)\Kaseya\XXX XXXX\KaseyaD.ini. This file contains sensitive information including Agent_Guid and AgentPassword values that are hardcoded and predictable within the installation process. The vulnerability classification aligns with CWE-200 (Information Exposure) and CWE-306 (Missing Authentication) as it exposes credentials through an unauthenticated access point while failing to properly validate authentication requests.
The operational impact of this vulnerability extends far beyond simple credential exposure, as it enables attackers to obtain session identifiers that can be used to execute subsequent attacks against the compromised system. The dl.asp endpoint accepts authentication credentials through GET requests, which violates secure coding practices and creates an additional attack vector where credentials can be intercepted or manipulated. This approach to authentication handling directly relates to CWE-287 (Improper Authentication) and CWE-312 (Cleartext Storage of Sensitive Data) as it exposes authentication tokens in URL parameters and stores credentials in easily accessible configuration files.
The exploitation chain demonstrates a sophisticated approach to privilege escalation where attackers can leverage the initial credential exposure to obtain a sessionId cookie that provides semi-authenticated access to system services not intended for agent use. This cookie-based authentication bypass allows attackers to navigate the system with elevated privileges, potentially accessing administrative functions, client management interfaces, and other sensitive system components. The attack pattern aligns with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as it exploits legitimate system functionality while leveraging exposed credentials to maintain persistence and escalate privileges.
The security implications of this vulnerability are severe as it provides attackers with sufficient information to penetrate the entire Kaseya installation and its connected clients, potentially affecting thousands of endpoints within a single compromised system. The combination of unauthenticated access, credential leakage through configuration files, and session management flaws creates a comprehensive attack surface that allows for both initial compromise and sustained access. Organizations using vulnerable Kaseya VSA versions face significant risk of lateral movement, data exfiltration, and system-wide compromise, particularly when the software is deployed in enterprise environments where it manages critical infrastructure components.
Mitigation strategies for this vulnerability require immediate patching to Kaseya VSA version 9.5.7 or later, which addresses the credential exposure and authentication bypass issues. Additionally, network segmentation should be implemented to restrict access to the dl.asp endpoint, while monitoring should be deployed to detect suspicious GET requests containing authentication parameters. Security controls should include disabling unnecessary download functionality, implementing proper access controls for the configuration directory, and establishing regular credential rotation procedures. The incident highlights the importance of secure default configurations and proper authentication handling in enterprise management software, as well as the necessity of continuous security monitoring to detect and respond to exploitation attempts.