CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15506
https://notcve.org/view.php?id=CVE-2019-15506
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. • http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htm • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 10%CPEs: 3EXPL: 1CVE-2018-20753 – Kaseya VSA Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-20753
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. Kaseya VSA RMM, en versiones anteriores a la R9.3 9.3.0.35, versiones R4 anteriores a la 9.4.0.36 y en las R9.5 anteriores a la 9.5.0.5, permite a los atacantes remotos sin privilegios ejecutar cargas útiles PowerShell en todos los dispositivos gestionados. En enero de 2018, los atacantes explotaban esta vulnerabilidad "in the wild" de manera activa. Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. • https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88 https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152 •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12410 – Kaseya Virtual System Administrator (VSA) Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with "NT AUTHORITY\SYSTEM" privileges. Es posible explotar una vulnerabilidad Time of Check Time of Use (TOCTOU) al ganar una condición de carrera cuando las versiones 9.3.0.11 y anteriores del agente Kaseya Virtual System Administrator intentan ejecutar sus binarios de las carpetas de trabajo y/o temporales. Resultados de explotación exitosos en la ejecución de programas arbitrarios con privilegios "NT AUTHORITY\SYSTEM". The Kaseya Virtual System Administrator (VSA) agent "AgentMon.exe" suffers from a local privilege escalation vulnerability. • http://www.securityfocus.com/archive/1/541884/100/0/threaded • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 17%CPEs: 4EXPL: 3CVE-2015-6589 – Kaseya Virtual System Administrator Authenticated Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. La vulnerabilidad de Salto de Directorio en Kaseya Virtual System Administrator (VSA) versiones 7.0.0.0 anteriores a 7.0.0.33, versiones 8..0.0.0 anteriores a 8.0.0.23, versiones 9.0.0.0 anteriores a 9.0.0.19 y versiones 9.1.0.0 anteriores a 9.1.0.9, permite a usuarios autenticados remotos escribir y ejecutar archivos arbitrarios debido a restricciones insuficientes en las rutas de archivos en el archivo json.ashx. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is required to exploit this vulnerability. The specific flaw exists within the json.ashx HTTP handler, which does not restrict destination file paths. Attackers can leverage this vulnerability to upload and execute arbitrary code on the server under the context of IIS. • https://www.exploit-db.com/exploits/43882 https://www.exploit-db.com/exploits/38351 http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html http://www.zerodayinitiative.com/advisories/ZDI-15-450 https://www.securityfocus.com/bid/76838 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 94%CPEs: 4EXPL: 3CVE-2015-6922 – Kaseya Virtual System Administrator Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6922
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx. Kaseya Virtual System Administrator (VSA) versiones 7.x anteriores a 7.0.0.33, versiones 8.x anteriores a 8.0.0.23, versiones 9.0 anteriores a 9.0.0.19 y versiones 9.1 anteriores a 9.1.0.9, no requiere autenticación, lo que permite a atacantes remotos omitir la autenticación y ( 1) agregar una cuenta administrativa mediante una petición diseñada en el archivo LocalAuth/setAccount.aspx o (2) escribir y ejecutar archivos arbitrarios por medio de un nombre de ruta completo en el parámetro PathData en el archivo ConfigTab/uploader.aspx. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the uploader.aspx page, which does not properly require that users be authenticated and does not restrict destination file paths. Attackers can leverage this vulnerability to upload and execute arbitrary code on the server under the context of IIS. • https://www.exploit-db.com/exploits/38351 https://www.exploit-db.com/exploits/38401 http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html http://www.zerodayinitiative.com/advisories/ZDI-15-448 http://www.zerodayinitiative.com/advisories/ZDI-15-449 https://helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Kaseya/kaseya-vsa-vuln-2.txt https://seclists.org/bugtraq/2015 • CWE-287: Improper Authentication •