PT-2021-18612 · Kaseya · Kaseya Vsa

Wietse Boonstra · Published 2021-07-09 · Updated 2022-07-12 · CVE-2021-30120

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.7

Description The issue allows attackers to bypass the 2-factor authentication (2FA) requirement. This is possible because the need to use 2FA for authentication is enforced client-side instead of server-side, making it vulnerable to bypass using a local proxy. During the login process, after a user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. An attacker can use an intercepting proxy to change the value of MFARequired from True to False, resulting in no prompt for the second factor, yet the user is still logged in.

Recommendations For Kaseya VSA versions prior to 9.5.7, update to version 9.5.7 or later to resolve the issue. As a temporary workaround, consider implementing server-side enforcement of 2FA to prevent bypass attempts. Restrict access to the login process to minimize the risk of exploitation until the update is applied.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2021-30120

Affected Products

Kaseya Vsa

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-30120 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30120 · Vendor Advisory
• https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure · Patch
• https://t.me/true_secator/1905 · Telegram Post
• https://t.me/cvenotify/17347 · Telegram Post
• https://csrit.divd.nl/DIVD-2021-00011 · Note
• https://csrit.divd.nl/CVE-2021-30120 · Note