CVE-2021-30201
📋 TL;DR
This is an XML External Entity (XXE) vulnerability in Kaseya VSA's web service API that allows attackers to read arbitrary files on the server and potentially pivot into internal networks. The vulnerability affects Kaseya VSA systems with the vulnerable API endpoint exposed. Attackers can exploit this without authentication to exfiltrate sensitive configuration files and credentials.
💻 Affected Systems
- Kaseya Virtual System Administrator (VSA)
📦 What is this software?
Vsa by Kaseya
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Kaseya server leading to credential theft, lateral movement through the network, and potential ransomware deployment across managed endpoints.
Likely Case
Exfiltration of sensitive configuration files containing credentials, enabling further attacks against the Kaseya infrastructure and managed systems.
If Mitigated
Limited to denial of service through error generation if external entity resolution is blocked but XML parsing still fails.
🎯 Exploit Status
The exploit requires only HTTP POST requests with crafted XML payloads and has been used in real-world attacks including the 2021 Kaseya ransomware incident.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.5.6 (Feature Release 8, May 2021)
Vendor Advisory: https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download Kaseya VSA 9.5.6 or later from Kaseya support portal. 3. Run the installer on the VSA server. 4. Restart the Kaseya services. 5. Verify the patch by checking the version in the VSA interface.
🔧 Temporary Workarounds
Disable XXE Processing in XML Parser
windowsConfigure the XML parser to disable external entity resolution and DTD processing
For .NET applications: Set XmlReaderSettings.DtdProcessing = DtdProcessing.Prohibit and XmlReaderSettings.XmlResolver = null
Network Segmentation and Access Control
allRestrict access to the vulnerable endpoint using firewall rules or web application firewalls
Block external access to /vsaWS/KaseyaWS.asmx at network perimeter
Implement IP whitelisting for the Kaseya API endpoint
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Kaseya VSA from other critical systems
- Deploy a web application firewall (WAF) with XXE protection rules in front of the Kaseya server
🔍 How to Verify
Check if Vulnerable:
Send a crafted XXE payload to POST /vsaWS/KaseyaWS.asmx and check if file contents are returned in error messagesCheck Version:
Check Help > About in Kaseya VSA web interface or examine installed programs in Windows Control PanelVerify Fix Applied:
Attempt the same XXE payload after patching - should receive generic error without file contents📡 Detection & Monitoring
Log Indicators:
- HTTP 500 errors with XML parsing exceptions in web server logs
- Unusual POST requests to /vsaWS/KaseyaWS.asmx with XML containing DOCTYPE or ENTITY declarations
- Outbound connections from Kaseya server to unexpected external IPs
Network Indicators:
- XML payloads containing external entity references in HTTP POST requests
- Unusual file read patterns from the Kaseya server process
SIEM Query:
source="web_server_logs" AND (uri="/vsaWS/KaseyaWS.asmx" AND status=500 AND message="XML" AND (message="entity" OR message="DTD"))🔗 References
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://csirt.divd.nl/CVE-2021-30201
- https://csirt.divd.nl/DIVD-2021-00011
- https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://csirt.divd.nl/CVE-2021-30201
- https://csirt.divd.nl/DIVD-2021-00011
- https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021
