CVE-2021-30116

CVE-2021-30116: Kaseya VSA Credential Disclosure via Client Installer Leak

AI-generated analysis based on the vulnerability data on this page.

Summary

Kaseya VSA before 9.5.7 exposes agent credentials through an unauthenticated client download endpoint (/dl.asp). An attacker can download a legitimate VSA agent installer, extract hardcoded credentials from the generated KaseyaD.ini file, and use those credentials to authenticate against the same download page. This yields a valid sessionId cookie that bypasses normal authentication and enables further semi-authenticated attacks against the VSA server and its managed clients. This vulnerability was actively exploited in the wild in July 2021 in conjunction with the REvil ransomware campaign.

Background

Kaseya VSA is a widely deployed remote monitoring and management (RMM) platform used by managed service providers (MSPs) to administer endpoints at scale. In July 2021, the platform became the focal point of a major supply-chain attack when threat actors leveraged multiple vulnerabilities—including this credential disclosure flaw—to compromise VSA servers and push ransomware downstream to MSP customers. The Dutch Institute for Vulnerability Disclosure (DIVD) and CISA both published advisories highlighting the severity of the exposure. Because VSA agents are pre-configured with credentials to phone home, those same credentials became a pathway for lateral movement and server compromise.

Root Cause

CWE-522: Insufficiently Protected Credentials.

The root cause is a design flaw in how Kaseya VSA provisions agent credentials. When a Windows agent installer is downloaded from the unauthenticated /dl.asp page and installed, it creates a local configuration file (KaseyaD.ini) containing an Agent_Guid and AgentPassword. These values are not unique to the endpoint or tied to a specific user session; instead, they are effectively shared secrets that the agent uses to authenticate back to the VSA server. The /dl.asp endpoint itself accepts these credentials via a GET request query string, returning a session cookie upon successful validation. Because the download page is unauthenticated, anyone can obtain the installer, extract the credentials, and replay them to obtain a session token. This is a classic case of credentials being insufficiently protected in transit and at rest, compounded by the fact that the same secret is reused across agents.

Impact

The CVSS v3 score of 10.0 (Critical) reflects the severity of this vulnerability:

• Attack Vector (AV): Network — The /dl.asp endpoint is reachable over the network.
• Attack Complexity (AC): Low — No special tools or conditions are required; downloading an installer and reading a local file is trivial.
• Privileges Required (PR): None — The download page is unauthenticated.
• User Interaction (UI): None — The attacker does not need to trick a user.
• Scope (S): Changed — Compromising the VSA server can affect all managed clients.
• Confidentiality (C): High — The attacker gains access to the VSA server and its managed endpoints.
• Integrity (I): High — Session hijacking allows the attacker to modify policies, deploy scripts, or push malware.
• Availability (A): High — The attacker can disrupt service or deploy ransomware, as observed in the July 2021 incidents.

In practice, this flaw was a prerequisite for downstream exploitation; it did not grant remote code execution by itself, but it bypassed authentication and enabled threat actors to chain additional vulnerabilities against the VSA server.

Exploitation Walkthrough

Ethics Notice: This section describes the vulnerability mechanism from a defensive perspective only. The purpose is to help defenders understand the attack surface and validate mitigations. No weaponized exploit code is provided.

1. Reconnaissance: The attacker identifies an on-premise Kaseya VSA server (typically via internet scanning for known VSA endpoints or MSP infrastructure).
2. Download: The attacker visits the unauthenticated client download page at https://<vsa-server>/dl.asp.
3. Installer Extraction: The attacker downloads the Windows VSA agent installer and installs it in a controlled environment.
4. Credential Harvesting: After installation, the attacker opens the generated KaseyaD.ini file (located under C:\Program Files (x86)\Kaseya\<agent-id>\KaseyaD.ini) and extracts the Agent_Guid and AgentPassword values.
5. Session Acquisition: The attacker issues a GET request to /dl.asp with the harvested un (Agent_Guid) and pw (AgentPassword) parameters. The server validates the credentials and returns a sessionId cookie.
6. Lateral Abuse: With the session cookie, the attacker can access VSA services not intended for agents, chaining additional vulnerabilities or abusing administrative functionality to compromise the server and its managed clients.

This sequence was observed in the wild during the July 2021 REvil campaign, where compromised VSA servers were used to distribute ransomware to downstream customers.

Affected and Patched Versions

Exact patch details should be verified against Kaseya's official release notes. The CPE identifiers registered in NVD are cpe:2.3:a:kaseya:vsa_agent:*:*:*:*:*:*:*:* and cpe:2.3:a:kaseya:vsa_server:*:*:*:*:*:*:*:*.

Remediation

Primary:

• Upgrade Kaseya VSA Server and agents to version 9.5.7 or later as soon as possible. Kaseya released this patch specifically to address the credential disclosure and authentication bypass issues exploited during the July 2021 incidents.

Compensating Controls (if immediate patching is not feasible):

• Network Segmentation: Restrict access to /dl.asp and the VSA web interface to trusted IP ranges or VPN-only access. Do not expose the VSA server directly to the internet unless absolutely necessary.
• WAF / Reverse Proxy Rules: Implement Web Application Firewall rules to block or rate-limit requests to /dl.asp from untrusted sources.
• Credential Rotation: If supported by your version, rotate agent credentials and ensure they are unique per endpoint rather than shared across the fleet.
• Monitoring: Deploy network and endpoint monitoring to detect unusual access to /dl.asp or anomalous sessionId cookie usage from unexpected source IPs.
• Disable Unnecessary Endpoints: If the client download page is not required for remote onboarding, disable or relocate it behind authenticated portals.

Detection

Defenders can detect exploitation or attempted exploitation through the following indicators:

• Web Server Logs: Monitor for repeated or anomalous GET requests to /dl.asp, especially from unexpected source IPs or geolocations.
• Authentication Anomalies: Alert on sessionId cookie issuance to /dl.asp when the source IP is not associated with a known managed endpoint.
• File Integrity: Monitor for unexpected access to KaseyaD.ini on endpoints, or detect instances where the file is copied, archived, or exfiltrated.
• Network Traffic: Look for inbound connections to /dl.asp followed by outbound sessions to the VSA API from the same source IP, which may indicate a successful session hijacking attempt.
• Endpoint Detection: Use EDR tools to flag when the VSA agent installer is downloaded and executed on non-managed or non-standard devices.

Assessment

EPSS & KEV Context:

With an EPSS score of 0.85619, this vulnerability sits in the top ~0.3% of all CVEs by exploitation probability. Its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog on 2021-11-03—and the EU's exploited vulnerability database on the same date—confirms that threat actors have weaponized this flaw in real campaigns. The July 2021 REvil ransomware attacks are the canonical example of its impact at scale.

Key Lessons:

1. Credentials Embedded in Client Software Are a Liability: Any secret shipped inside a downloadable client installer can be extracted by an attacker. Authentication should rely on per-device, per-user, or ephemeral credentials—not hardcoded or shared secrets.
2. Unauthenticated Endpoints Are Prime Attack Surface: A seemingly innocuous download page can become a critical vulnerability when it leaks authentication material. Every unauthenticated endpoint should be evaluated for information disclosure risks.

References

• https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
• https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
• https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
• https://www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30116