CVE-2017-18362

CVE-2017-18362: Unauthenticated SQL Injection in ConnectWise ManagedITSync for Kaseya VSA

AI-generated analysis based on the vulnerability data on this page.

Summary

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA contains an unauthenticated SQL injection vulnerability in the ManagedIT.asmx web service. Any remote attacker with network access to the page can execute arbitrary SQL queries against the Kaseya VSA database without authentication, granting full read and write capabilities. This vulnerability was actively exploited in the wild in February 2019 to deploy ransomware across all endpoints managed by compromised VSA servers.

Background

Kaseya VSA is a remote monitoring and management (RMM) platform widely used by managed service providers (MSPs) to administer client endpoints. ConnectWise ManagedITSync was an integration component designed to synchronize data between ConnectWise and Kaseya VSA environments. The integration exposed a web service endpoint (ManagedIT.asmx) that interacted directly with the VSA backend database. Due to insufficient input validation and lack of authentication on this endpoint, it became a critical attack vector.

Root Cause

The vulnerability is classified as CWE-89: SQL Injection. The ManagedIT.asmx page accepted user-supplied input and incorporated it directly into database queries without proper sanitization, parameterization, or authentication checks. This design flaw allowed an unauthenticated remote attacker to inject arbitrary SQL commands, effectively bypassing all access controls and interacting with the database as a privileged user. The lack of any authentication requirement on a page with direct database access represents a fundamental architectural weakness.

Impact

• CVSS v3.1 Score: 9.8 (CRITICAL) — Network attackable, low complexity, no privileges required, no user interaction.
• Confidentiality Impact: HIGH — Full database read access exposes sensitive customer data, credentials, and configuration details.
• Integrity Impact: HIGH — Attackers can modify database records, potentially altering endpoint policies or adding malicious accounts.
• Availability Impact: HIGH — Database manipulation or ransomware payload deployment can render managed endpoints unusable.
• CVSS v2 Score: 7.5 — Confirms network-accessible, unauthenticated attack with partial impacts across the CIA triad.

Exploitation Walkthrough

Defensive Context Only — No weaponized instructions are provided.

From a defender's perspective, exploitation typically follows this pattern:

1. Reconnaissance: The attacker identifies an internet-facing Kaseya VSA instance with the ManagedIT.asmx endpoint exposed.
2. Injection: The attacker submits crafted requests to the endpoint containing SQL syntax that the backend database executes without validation.
3. Enumeration: The attacker queries database tables to extract endpoint lists, agent credentials, or administrative accounts.
4. Action on Objectives: With full database access, the attacker may deploy remote commands to all managed endpoints — in confirmed incidents, this was used to stage and execute ransomware payloads.

Ethics Notice: This description is intentionally high-level and generic. It is intended to aid defenders in understanding attack flow for detection and mitigation purposes, not to enable unauthorized access.

Affected and Patched Versions

• Affected: ConnectWise ManagedITSync through 2017 for Kaseya VSA
• CPE: cpe:2.3:a:connectwise:manageditsync:*:*:*:*:*:kaseya_vsa:*:*
• Patched Version: Specific patch information is not available in the disclosed data. Administrators should consult Kaseya/ConnectWise documentation or remove the integration if unmaintained.

Remediation

1. Immediate: Restrict or disable access to the ManagedIT.asmx endpoint if it is no longer required. Do not expose it to untrusted networks.
2. Upgrade: Apply any vendor-supplied patches or updates for ConnectWise ManagedITSync. If the integration is end-of-life, decommission it.
3. Compensating Controls:
   • Implement network segmentation to ensure RMM interfaces are not internet-facing.
   • Enforce IP allowlisting for any administrative or integration endpoints.
   • Apply principle of least privilege to database accounts used by integration components.
   • Monitor for unauthenticated requests to .asmx endpoints within the VSA environment.

Detection

• Monitor web server logs for unauthenticated HTTP requests to /ManagedIT.asmx or similar integration endpoints.
• Alert on SQL error messages or anomalous query patterns originating from the VSA application layer.
• Track for unauthorized database schema enumeration or bulk data exfiltration events.
• Correlate endpoint behavior: simultaneous ransomware-like file activity across all managed agents may indicate mass exploitation of this vulnerability.

Assessment

• EPSS Score: 0.86706 with a 99.72nd percentile indicates an extremely high probability of active exploitation in the wild.
• KEV Status: Added to the CISA Known Exploited Vulnerabilities catalog on 2022-05-24, and the EU Exploited Vulnerabilities Database confirms in-the-wild exploitation since the same date.
• Historical Context: February 2019 saw confirmed ransomware campaigns leveraging this flaw, demonstrating its real-world destructive impact.
• Lessons: (1) Integration endpoints must never be exposed without robust authentication and input validation. (2) RMM platforms are high-value targets; any unauthenticated path to database control should be treated as a critical architectural defect.

References

• http://archive.today/rdkeQ
• https://github.com/kbni/owlky
• https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362