CVE-2021-30118 : Security Advisory and Response

A detailed overview of the Unauthenticated Remote Code Execution vulnerability identified in Kaseya VSA < v9.5.5, its impact, technical details, and mitigation steps.

Understanding CVE-2021-30118

This CVE describes a critical vulnerability in Kaseya VSA that allows an attacker to upload files with the privilege of the Web Server process, leading to remote code execution.

What is CVE-2021-30118?

The vulnerability enables an unauthenticated attacker to upload files to the server, execute malicious commands, and potentially compromise the system's integrity and confidentiality.

The Impact of CVE-2021-30118

Exploitation of this vulnerability can result in an attacker gaining control over the server, executing arbitrary code, and accessing sensitive information, leading to a full system compromise.

Technical Details of CVE-2021-30118

The vulnerability exists in the

uploader.aspx

API of Kaseya VSA, allowing an attacker to upload files and execute arbitrary commands.

Vulnerability Description

The flaw allows an attacker to upload files with the Web Server process privilege, potentially compromising system confidentiality, integrity, and availability.

Affected Systems and Versions

Kaseya VSA Unified Remote Monitoring & Management (RMM) version 9.5.4.2149 and below are susceptible to this vulnerability.

Exploitation Mechanism

By crafting a specific HTTP request to

uploader.aspx

, an attacker can upload malicious files to the server and leverage them to execute arbitrary commands.

Mitigation and Prevention

To address CVE-2021-30118, immediate steps must be taken to secure affected systems and prevent potential malicious activities.

Immediate Steps to Take

Ensure immediate patching or upgrading to version 9.5.6 or higher to mitigate this vulnerability. Additionally, restrict access to the vulnerable API and validate session IDs.

Long-Term Security Practices

Regularly update software and implement secure coding practices to prevent similar vulnerabilities in the future. Conduct security audits to identify and mitigate potential risks.

Patching and Updates

The vendor has released a fix for the SaaS version and recommends upgrading the on-premise version to 9.5.6 or above to address the vulnerability effectively.