CVE-2021-30116
📋 TL;DR
CVE-2021-30116 is an authentication bypass vulnerability in Kaseya VSA that allows unauthenticated attackers to obtain agent credentials and use them to gain authenticated access. This affects Kaseya VSA on-premise installations before version 9.5.7. Attackers can leverage this to compromise the Kaseya management system and potentially all managed endpoints.
💻 Affected Systems
- Kaseya Virtual System Administrator (VSA)
📦 What is this software?
Vsa Agent by Kaseya
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Kaseya VSA management server leading to ransomware deployment across all managed endpoints, data exfiltration, and lateral movement throughout the enterprise network.
Likely Case
Attackers gain administrative access to Kaseya VSA, deploy malware to managed endpoints, and potentially encrypt systems with ransomware as seen in the REvil attacks of July 2021.
If Mitigated
Limited impact if proper network segmentation, monitoring, and access controls prevent lateral movement from compromised systems.
🎯 Exploit Status
Actively exploited in the wild by REvil ransomware group in July 2021. Exploitation requires downloading agent installer and extracting credentials from KaseyaD.ini file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.5.7
Vendor Advisory: https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
Restart Required: Yes
Instructions:
1. Immediately upgrade Kaseya VSA to version 9.5.7 or later. 2. Follow Kaseya's emergency security patch instructions. 3. Restart the VSA server and all managed agents. 4. Rotate all credentials and session tokens.
🔧 Temporary Workarounds
Disable dl.asp endpoint
windowsBlock or disable the vulnerable dl.asp download page to prevent credential leakage
# Configure web server to block access to /dl.asp
# Use IIS URL Rewrite or similar to deny access
Network segmentation and firewall rules
windowsRestrict access to Kaseya VSA server to only trusted management networks
# Example firewall rule to restrict access
New-NetFirewallRule -DisplayName "Block Kaseya External" -Direction Inbound -Protocol TCP -LocalPort 443 -RemoteAddress Internet -Action Block
🧯 If You Can't Patch
- Immediately take Kaseya VSA servers offline and disconnect from networks
- Implement strict network segmentation and monitor all traffic to/from Kaseya servers
🔍 How to Verify
Check if Vulnerable:
Check if Kaseya VSA version is below 9.5.7 and verify if https://[server]/dl.asp is accessible without authenticationCheck Version:
Check Kaseya VSA web interface or server properties for version informationVerify Fix Applied:
Verify Kaseya VSA version is 9.5.7 or later and test that dl.asp no longer accepts agent credentials for authentication📡 Detection & Monitoring
Log Indicators:
- Unusual access to dl.asp endpoint
- Multiple failed authentication attempts followed by successful agent authentication
- Unexpected agent installations or connections
Network Indicators:
- HTTP GET requests to dl.asp with credential parameters
- Unusual outbound connections from Kaseya server
- Traffic patterns matching REvil ransomware indicators
SIEM Query:
source="kaseya.logs" AND (uri="/dl.asp" OR (event="authentication" AND user="agent_*"))🔗 References
- https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
- https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
- https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
- https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30116
