CVE-2021-30116
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021.
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 85.73%
- Chance of exploitation in the next 30 days. Higher than 99.73% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Nov 3, 2021
- Fix
- None yet
- No fixed version published
Description
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | Not rated yet | Same weakness, CWE-522 |
| GHSA-3wp9-xfwm-rjjf AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel | Medium | Same weakness, CWE-522 |
| GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host | Critical | Same weakness, CWE-522 |
| GHSA-rqf5-2wxv-rjf4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext | High | Same weakness, CWE-522 |
| GHSA-xr57-gcx8-52hf AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request | Medium | Same weakness, CWE-522 |
| GHSA-f8m2-889x-vw4x AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target | Medium | Same weakness, CWE-522 |
| GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth | Medium | Same weakness, CWE-522 |
| GHSA-486v-q2wf-fp2r rclone: http backend forwards custom/auth headers to a different host on redirect | Medium | Same weakness, CWE-522 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor