PT-2019-6222 · Kaseya · Kaseya Vsa

Published 2019-02-05 · Updated 2025-01-22 · CVE-2017-18362

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions through 2017

Description The issue allows unauthenticated remote commands, providing full direct access to the Kaseya VSA database. Attackers have exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page can run arbitrary SQL queries, both read and write, without authentication.

Recommendations For versions through 2017, as a temporary workaround, consider restricting access to the ManagedIT.asmx page to minimize the risk of exploitation. Avoid using the Kaseya VSA web interface to run SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-04187

CVE-2017-18362

Affected Products

Kaseya Vsa

References · 9

• 🔥 https://github.com/kbni/owlky · Exploit
• https://osv.dev/vulnerability/CVE-2017-18362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18362 · Security Note
• https://bdu.fstec.ru/vul/2022-04187 · Security Note
• http://archive.today/rdkeQ · Note
• https://t.me/cvenotify/108265 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+ · Note