7.5 CVE-2021-30120
Used by Malware Used by Ransomware Patch
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
https://nvd.nist.gov/vuln/detail/CVE-2021-30120
Categories
CWE-669 : Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494). PHP-based FAQ management app does not check the MIME type for uploaded images Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).
References
cve@mitre.org Patch
| https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ Patch Third Party Advisory |
| https://csrit.divd.nl/CVE-2021-30120 Permissions Required Third Party Advisory |
| https://csrit.divd.nl/DIVD-2021-00011 Permissions Required Third Party Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:* | <= 9.5.6 | |
REMEDIATION
Patch
| Url |
|---|
| https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ |
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
