PT-2019-6222 · Kaseya · Kaseya Vsa

Publicado 2019-02-05 · Atualizado 2025-01-22 · CVE-2017-18362

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions through 2017

Description The issue allows unauthenticated remote commands, providing full direct access to the Kaseya VSA database. Attackers have exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page can run arbitrary SQL queries, both read and write, without authentication.

Recommendations For versions through 2017, as a temporary workaround, consider restricting access to the ManagedIT.asmx page to minimize the risk of exploitation. Avoid using the Kaseya VSA web interface to run SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2022-04187

CVE-2017-18362

Produtos afetados

Kaseya Vsa

Referências · 9

• 🔥 https://github.com/kbni/owlky · Exploit
• https://osv.dev/vulnerability/CVE-2017-18362 · Aviso do Fabricante
• http://archive.today/rdkeQ · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-18362 · Nota de Segurança
• https://t.me/cvenotify/108265 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2022-04187 · Nota de Segurança
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362 · Nota
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+ · Nota