PT-2015-7305 · Kaseya · Kaseya Virtual System Administrator

Pedro Ribeiro · Published 2015-09-23 · Updated 2020-02-25 · CVE-2015-6589

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator versions 7.0.0.0 through 7.0.0.32 Kaseya Virtual System Administrator versions 8.0.0.0 through 8.0.0.22 Kaseya Virtual System Administrator versions 9.0.0.0 through 9.0.0.18 Kaseya Virtual System Administrator versions 9.1.0.0 through 9.1.0.8

Description The issue allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to "json.ashx". This can lead to remote code execution.

Recommendations For versions 7.0.0.0 through 7.0.0.32, update to version 7.0.0.33 or later. For versions 8.0.0.0 through 8.0.0.22, update to version 8.0.0.23 or later. For versions 9.0.0.0 through 9.0.0.18, update to version 9.0.0.19 or later. For versions 9.1.0.0 through 9.1.0.8, update to version 9.1.0.9 or later. As a temporary workaround, consider restricting access to the "json.ashx" endpoint until a patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-6589

ZDI-15-450

Affected Products

Kaseya Virtual System Administrator

References · 8

• 🔥 https://exploit-db.com/exploits/38351 · Exploit
• 🔥 https://exploit-db.com/exploits/43882 · Exploit
• 🔥 http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html · Exploit
• https://zerodayinitiative.com/advisories/ZDI-15-450 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6589 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-450 · Note
• https://securityfocus.com/bid/76838 · Note
• https://t.me/cvenotify/1020 · Telegram Post