QID 731317

Date Published: 2024-04-04

QID 731317: Kaseya VSA Remote Code Execution (RCE) Vulnerability

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page can run arbitrary SQL queries, both read and write, without authentication.

Affected Versions:
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA

QID Detection Logic (Unauthenticated):
This QID checks for vulnerable Kaseya VSA targets by checking if the 'ManagedIT.asmx' endpoint is accessible.

Successful exploitation of the vulnerability may allow an unauthenticated attacker to execute arbitrary code remotely, leading to critical data loss and potential system compromise.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

ConnectWise ManagedITSync integration for Kaseya VSA is End Of Life (EOL) and should be disconnected if still in use.

Vendor References

CVEs related to QID 731317

CVE-2017-18362 |

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].