PT-2021-7745 · Kaseya · Kaseya Vsa

Wietse Boonstra · Published 2021-04-01 · Updated 2022-04-29 · CVE-2021-30117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.6

Description The issue is related to a semi-authenticated boolean-based blind SQL injection in the fldrId parameter of the /InstallTab/exportFldr.asp API endpoint. This allows a remote attacker to execute arbitrary SQL code. The vulnerability can be exploited by manipulating the fldrId parameter, as demonstrated by setting it to (SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)), which results in a successful request.

Recommendations For versions prior to 9.5.6, update to version 9.5.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the /InstallTab/exportFldr.asp API endpoint to minimize the risk of exploitation. Avoid using the fldrId parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-02419

CVE-2021-30117

Affected Products

Kaseya Vsa

References · 8

• https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30117 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-30117 · Security Note
• https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure · Note
• https://t.me/cibsecurity/26034 · Telegram Post
• https://t.me/cvenotify/17349 · Telegram Post
• https://xakep.ru/2021/07/12/kaseya-patches · Note