CVE-2021-30117 : Vulnerability Insights and Analysis

Authored by Wietse Boonstra and Frank Breedijk of DIVD, CVE-2021-30117 highlights an authenticated SQL injection vulnerability in Kaseya VSA versions prior to v9.5.6.

Understanding CVE-2021-30117

This CVE exposes a semi-authenticated boolean-based blind SQL injection flaw in the API call /InstallTab/exportFldr.asp, specifically in the parameter fldrId.

What is CVE-2021-30117?

The vulnerability allows an attacker to manipulate the fldrId parameter, leading to unauthorized SQL queries, potentially compromising the confidentiality and integrity of the system.

The Impact of CVE-2021-30117

With a CVSS v3.1 base score of 9.8, this critical vulnerability can result in high confidentiality and integrity impacts, posing a significant threat to affected systems.

Technical Details of CVE-2021-30117

The vulnerability arises due to improper input validation in the fldrId parameter of the /InstallTab/exportFldr.asp API call. An attacker can exploit this to inject malicious SQL queries.

Vulnerability Description

By crafting specific SQL payloads in the fldrID parameter, an attacker can perform unauthorized actions and potentially extract sensitive data from the affected system.

Affected Systems and Versions

Kaseya VSA versions prior to v9.5.6 are impacted by this vulnerability, exposing them to the risk of a successful SQL injection attack.

Exploitation Mechanism

Attackers can exploit the vulnerability by manipulating the fldrId parameter in the API call, allowing them to execute malicious SQL queries and retrieve sensitive information.

Mitigation and Prevention

To address CVE-2021-30117, immediate action is crucial to prevent potential exploitation and secure the affected systems.

Immediate Steps to Take

For SaaS versions, ensure that the vendor has applied the necessary fixes.
Onpremise deployments should be upgraded to Kaseya VSA version 9.5.6 or above.
Additionally, upgrade agents to version 9.5.0.23 or higher to mitigate the risk of exploitation.

Long-Term Security Practices

Implement strict input validation mechanisms to prevent SQL injection vulnerabilities in software applications.

Patching and Updates

Regularly apply security patches and updates provided by Kaseya to ensure the protection of the system against known vulnerabilities.