CVE-2017-18362
Kaseya VSA SQL Injection Vulnerability
Description
CVE-2017-18362 is a critical vulnerability in the ConnectWise ManagedITSync integration for Kaseya VSA (Virtual System/Server Administrator) that allows unauthenticated remote attackers to execute arbitrary commands with full direct access to the Kaseya VSA database. The vulnerability stems from insufficient input validation in the integration module, enabling SQL injection or command injection attacks without any authentication. Successful exploitation grants attackers complete control over managed IT environments. CVE-2017-18362 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a confirmed ransomware association, and its EPSS percentile of 99.1% indicates near-certain active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| connectwise | manageditsync | <= 2017 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://archive.today/rdkeQ(Third Party Advisory)
- https://github.com/kbni/owlky(Exploit, Third Party Advisory)
- https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+(Broken Link, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 describes a weakness where a product constructs SQL statements using externally-influenced input without properly neutralizing special elements that could modify the intended SQL command. In CVE-2017-18362, the ConnectWise ManagedITSync integration for Kaseya VSA fails to sanitize user-supplied input, allowing unauthenticated attackers to inject SQL commands and gain full access to the underlying Kaseya VSA database.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2017-18362 enables unauthenticated remote access to the Kaseya VSA database through the ConnectWise ManagedITSync integration. The impact is catastrophic for managed service providers (MSPs) using this combination, as Kaseya VSA is a remote monitoring and management (RMM) platform that controls potentially thousands of client endpoints. Full database access allows attackers to steal credentials, modify agent configurations, deploy malicious payloads to all managed endpoints, and exfiltrate sensitive customer data. The EPSS percentile of 99.1% reflects near-certain exploitation activity. CISA has confirmed a ransomware association with this vulnerability, highlighting its use in campaigns where attackers leveraged MSP tools to distribute ransomware across entire client bases simultaneously.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-18362 and added it to the Known Exploited Vulnerabilities catalog with a confirmed ransomware association and a remediation deadline of June 14, 2022. The EPSS percentile of 99.1% indicates near-certain exploitation probability. The impacted product, ConnectWise ManagedITSync for Kaseya VSA, is end-of-life, meaning no further patches will be released. This vulnerability was exploited in real-world ransomware campaigns targeting managed service providers, where attackers used the database access to push ransomware to all endpoints managed through the compromised Kaseya VSA instance, amplifying the impact exponentially across MSP customer bases.
Remediation
- Disconnect the ConnectWise ManagedITSync integration for Kaseya VSA immediately, as CISA's KEV catalog states that the impacted product is end-of-life and should be disconnected if still in use.
- Audit the Kaseya VSA database for signs of unauthorized access, including unexpected database queries, modified agent configurations, or newly created administrative accounts.
- Review all managed endpoints for indicators of compromise, particularly signs of ransomware deployment or unauthorized software installation that may have been pushed through the compromised VSA instance.
- Replace the end-of-life ManagedITSync integration with a supported integration solution that receives regular security updates and proper input validation.
- Implement network-level access controls around the Kaseya VSA infrastructure, restricting database access to only authorized management interfaces and monitoring all database connections for anomalous activity.
Technical Details
CVE-2017-18362 targets the ConnectWise ManagedITSync integration module for Kaseya VSA. The integration exposes an endpoint that accepts external input without proper sanitization, classified under CWE-89 (SQL Injection). An unauthenticated remote attacker can send specially crafted requests to this endpoint, injecting SQL commands that are executed directly against the Kaseya VSA database. Because no authentication is required and the injected commands run with the database service's full privileges, the attacker gains unrestricted read and write access to all data stored in VSA, including managed device inventories, credentials, agent configurations, and scheduled tasks. The attack vector is network-based with low complexity and requires no privileges or user interaction. The end-of-life status of the ManagedITSync product means this vulnerability will never be patched, making complete removal the only viable remediation.
Frequently Asked Questions
Is CVE-2017-18362 being actively exploited?
Yes, CVE-2017-18362 has been actively exploited in ransomware campaigns targeting managed service providers. CISA has confirmed active exploitation and added it to the KEV catalog with a ransomware association. The EPSS percentile of 99.1% reflects near-certain exploitation activity.
What products are affected by CVE-2017-18362?
CVE-2017-18362 affects the ConnectWise ManagedITSync integration for Kaseya VSA (Virtual System/Server Administrator). This product is end-of-life and no longer receives security updates. Organizations using this integration are at critical risk.
How do I fix CVE-2017-18362?
The affected product is end-of-life and cannot be patched. CISA recommends disconnecting the ConnectWise ManagedITSync integration immediately. Replace it with a supported alternative and audit all managed endpoints for signs of compromise. See the Remediation section for detailed steps.
How severe is CVE-2017-18362?
CVE-2017-18362 is a critical vulnerability with an EPSS percentile of 99.1% and a confirmed ransomware association. It allows unauthenticated full database access to Kaseya VSA, which manages potentially thousands of client endpoints. The combination of no authentication requirement, end-of-life status, and ransomware exploitation makes this one of the most dangerous vulnerabilities for managed service providers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.