CVE-2021-30116
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
Description
CVE-2021-30116 is a critical information disclosure vulnerability in Kaseya Virtual System/Server Administrator (VSA) with a maximum CVSS score of 10.0. The vulnerability exists in the default download page (dl.asp) of on-premise Kaseya VSA installations, which exposes agent credentials. When an attacker installs the downloadable Windows client, the generated KaseyaD.ini file contains an Agent_Guid and AgentPassword. These credentials can be submitted to dl.asp via a simple GET request, which returns a sessionId cookie. This session cookie can then be used to bypass authentication and execute further attacks against the entire Kaseya infrastructure and its managed clients. The vulnerability was actively exploited by the REvil ransomware group in July 2021 in a massive supply-chain attack that impacted thousands of downstream organizations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| kaseya | vsa agent | < 9.5.0.24 |
| kaseya | vsa server | < 9.5.7a |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/(Third Party Advisory)
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/(Third Party Advisory)
- https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021(Vendor Advisory)
- https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30116(US Government Resource)
Weakness Type
CWE-522: Insufficiently Protected Credentials
CWE-522 describes situations where a product transmits or stores authentication credentials in a manner that makes them susceptible to unauthorized interception or retrieval. In the case of CVE-2021-30116, Kaseya VSA agent credentials are stored in a plaintext configuration file and can be used to authenticate via an unauthenticated download page, fundamentally undermining the security of the entire credential management process.
Learn more: CWE-522 — Insufficiently Protected Credentials
Impact Analysis
The impact of CVE-2021-30116 is exceptionally severe, receiving a CVSS score of 10.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability is exploitable remotely over the network with low attack complexity, requires no privileges or user interaction, and has a changed scope, meaning it can affect resources beyond the vulnerable component. All three impact dimensions (confidentiality, integrity, and availability) are rated High. An attacker who obtains the session cookie effectively gains authenticated access to Kaseya VSA management functions, enabling them to deploy malicious payloads to all managed endpoints. This was demonstrated in the July 2021 REvil ransomware supply-chain attack, which propagated ransomware to approximately 1,500 organizations through compromised MSP instances. The vulnerability is known to have been used in ransomware campaigns.
Exploit Maturity
CVE-2021-30116 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021. The vulnerability has a high EPSS score of 0.531 (97.9th percentile), indicating a very high probability of exploitation. The REvil ransomware group famously exploited this vulnerability in July 2021 as part of a supply-chain attack targeting Kaseya VSA, impacting managed service providers and their downstream customers. Public exploit information and detailed technical advisories are available from DIVD CSIRT and security researchers.
Remediation
- Update Kaseya VSA immediately to version 9.5.7a or later for VSA Server and version 9.5.0.24 or later for VSA Agent, which contain the official patches for this vulnerability.
- Restrict network access to the Kaseya VSA web interface, particularly the dl.asp download page, using firewall rules and access control lists to limit exposure to trusted networks only.
- Rotate all agent credentials after applying the patch, as existing Agent_Guid and AgentPassword values stored in KaseyaD.ini files on managed endpoints may have been compromised.
- Monitor for indicators of compromise by reviewing VSA server logs for suspicious authentication attempts, unusual session creation, and unauthorized agent registrations.
- Implement network segmentation to isolate the Kaseya VSA management server from general network traffic and restrict outbound connections from managed endpoints.
- Review managed endpoints for signs of ransomware deployment or unauthorized software installation that may have occurred prior to patching.
Technical Details
The vulnerability resides in the architecture of Kaseya VSA's agent deployment mechanism. By default, Kaseya VSA on-premise installations expose a download page at /dl.asp where agent installation packages can be retrieved without authentication. When the Windows agent client is installed, it creates a configuration file at C:\Program Files (x86)\Kaseya<ID>\KaseyaD.ini containing the Agent_Guid and AgentPassword in plaintext. An attacker with access to this file, or who installs the freely downloadable agent, can use these credentials to authenticate against dl.asp via a GET request (e.g., /dl.asp?un=<Agent_Guid>&pw=
Frequently Asked Questions
Is CVE-2021-30116 being actively exploited?
Yes. CVE-2021-30116 was actively exploited by the REvil ransomware group in a major supply-chain attack in July 2021 that affected approximately 1,500 organizations worldwide through compromised managed service provider (MSP) instances. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been associated with ransomware campaigns.
What products are affected by CVE-2021-30116?
The vulnerability affects Kaseya VSA Server versions prior to 9.5.7a and Kaseya VSA Agent versions prior to 9.5.0.24. On-premise installations are particularly at risk because they expose the default download page (dl.asp) that leaks agent credentials.
How do I fix CVE-2021-30116?
Update Kaseya VSA Server to version 9.5.7a or later and VSA Agent to version 9.5.0.24 or later. After patching, rotate all agent credentials and review managed endpoints for signs of compromise. Restrict network access to the VSA web interface.
How severe is CVE-2021-30116?
CVE-2021-30116 has the maximum possible CVSS score of 10.0 (Critical). It allows unauthenticated remote attackers to obtain session credentials and gain management-level access to the entire Kaseya VSA infrastructure, including all managed endpoints. The vulnerability was used in one of the largest ransomware supply-chain attacks in history.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.