CVE-2019-14510

{"id": "CVE-2019-14510", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2019-10-11T12:15:11.050", "references": [{"url": "http://community.kaseya.com/xsp/f/355.aspx", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "http://community.kaseya.com/xsp/f/355/t/24675.aspx", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://lockstepgroup.com/blog/abusing-the-kaseya-lan-cache-fsadmin/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lockstepgroup.com/blog/cve-2019-14510-abusing-the-kaseya-lan-cache-fsadmin-red-team-edition/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.kaseya.com/products/vsa/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.)"}, {"lang": "es", "value": "Se detect\u00f3 un problema en Kaseya VSA RMM versiones hasta 9.5.0.22. Cuando es usada la configuraci\u00f3n predeterminada, la funcionalidad LAN Cache crea una cuenta local FSAdminxxxxxxxxx (por ejemplo, FSAdmin123456789) en el servidor que aloja la LAN Cache y todos los clientes asignados a una LAN Cache. Esta cuenta es colocada en el grupo de administradores locales de todos los clientes asignados a la LAN Cache. Cuando el cliente asignado es un Controlador de Dominio, la cuenta FSAdminxxxxxxxxx es creada como una cuenta de dominio y agregada autom\u00e1ticamente como miembro del grupo BUILTIN\\Administrators del dominio. Utilizando las conocidas t\u00e9cnicas Pass-the-Hash, un atacante puede usar el mismo hash de FSAdminxxxxxxxxx desde cualquier cliente de LAN Cache y pasarlo hacia un Controlador de Dominio, proporcionando derechos administrativos al atacante en cualquier Controlador de Dominio. (Las mitigaciones Pass-the-Hash de la cuenta local no protegen cuentas de dominio)."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaseya:vsa:*:*:*:*:rmm:*:*:*", "vulnerable": true, "matchCriteriaId": "6409EECE-A626-4D65-ABFD-B05DC5CB8218", "versionEndIncluding": "9.5.0.22"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}