CVE-2021-30116

Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

Vsa Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid…

9. Jul 2021

Ausgewertete Quellen

• Hersteller
  https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
• Hinweis
  https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
• Hinweis
  https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
• Hinweis
  https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30116
• CISA
  Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
• NVD
  CVE-2021-30116