CVE-2021-30116

{"id": "CVE-2021-30116", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2021-07-09T14:15:07.770", "references": [{"url": "https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\\Program Files (x86)\\Kaseya\\XXXXXXXXXX\\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system."}, {"lang": "es", "value": "Kaseya VSA antes de la versi\u00f3n 9.5.7 permite la divulgaci\u00f3n de credenciales, como se explot\u00f3 en la naturaleza en julio de 2021. Por defecto, Kaseya VSA on premise ofrece una p\u00e1gina de descarga donde se pueden descargar los clientes para la instalaci\u00f3n. La URL por defecto para esta p\u00e1gina es https://x.x.x.x/dl.asp. Cuando un atacante descarga un cliente para Windows y lo instala, se genera el archivo KaseyaD.ini (C:\\aArchivos de Programa (x86)\\aKaseyaXXXXXX\\aKaseyaD.ini) que contiene un Agent_Guid y AgentPassword. Este Agent_Guid y AgentPassword pueden ser utilizados para iniciar sesi\u00f3n en dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9). Esta solicitud autentifica al cliente y devuelve una cookie sessionId que puede ser utilizada en ataques posteriores para evadir la autenticaci\u00f3n. Problemas de seguridad descubiertos --- * La p\u00e1gina de descarga no autenticada filtra credenciales * Las credenciales del software del agente pueden ser usadas para obtener un sessionId (cookie) que puede ser usado para servicios no destinados a ser usados por los agentes * dl.asp acepta credenciales a trav\u00e9s de una solicitud GET * El acceso a KaseyaD.ini le da a un atacante acceso a suficiente informaci\u00f3n para penetrar la instalaci\u00f3n de Kaseya y sus clientes. Impacto --- A trav\u00e9s de la p\u00e1gina /dl.asp se puede obtener suficiente informaci\u00f3n para dar a un atacante un sessionId que puede ser usado para ejecutar m\u00e1s ataques (semiautenticados) contra el sistema"}], "lastModified": "2023-10-23T14:15:09.250", "cisaActionDue": "2021-11-17", "cisaExploitAdd": "2021-11-03", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaseya:vsa_agent:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2019D8D-BA9B-4DE2-8628-F0776FACE360", "versionEndExcluding": "9.5.0.24"}, {"criteria": "cpe:2.3:a:kaseya:vsa_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9529A08E-3306-4D61-AD50-D66548E7427A", "versionEndExcluding": "9.5.7a"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability"}