Kaseya VSA Credential Leak / Auth Bypass (REvil Supply Chain)
- Product
- Kaseya VSA (on-premises)
- CVE
- CVE-2021-30116
- Disclosed
- 2021-07-02
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Kaseya VSA on-premises before 9.5.7.
- Fixed
- VSA 9.5.7a (9.5.7.2994).
Summary
REvil exploited Kaseya VSA servers on 2 July 2021, pushing ransomware through VSA's agent update mechanism to about 60 MSPs and up to 1,500 downstream businesses. DIVD had reported the bugs to Kaseya weeks earlier.
Root cause
CVE-2021-30116 is a credential disclosure: the public agent download page (dl.asp) hands out installers that generate an agent GUID and password, which could be abused to authenticate to the VSA server. Attackers chained it with authentication bypass and file upload/code injection weaknesses in the VSA web interface to gain admin access and push a malicious 'Kaseya VSA Agent Hot-fix' procedure to managed endpoints.
Impact
Ransomware deployed to every endpoint managed by compromised VSA servers.
Detection
Run Kaseya's Compromise Detection Tool and look for agent.crt/agent.exe drops in the Kaseya working directory.
Mitigation
Upgrade to 9.5.7a or later and keep VSA servers off the internet.