Kaseya VSA uploader.aspx Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory leading to arbitrary code execution with IUSR privileges. This module has been tested with Kaseya v7.0.0.17...

Kaseya VSA Master Administrator Account Creation

This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new Master Administrator account. Normally this page is only accessible via the localhost interface, but the application does nothing to prevent this apart from attempting to force a redirect. This module has been...

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)

Kaseya Virtual System Administrator VSA - Multiple Vulnerabilities 2 Kaseya VSA is an IT management platform for small and medium corporates. From its console you can control thousands of computers and mobile devices. So that if you own the Kaseya server, you own the organisation. With this post...

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)

Kaseya VSA is an IT management platform for small and medium corporates. From its console you can control thousands of computers and mobile devices. So that if you own the Kaseya server, you own the organisation. With this post I'm also releasing two Metasploit modules E1, E2 and a Ruby file E3...

Kaseya Virtual System Administrator (VSA) 7.0 9.1 - (Authenticated) Arbitrary File Upload

Kaseya Virtual System Administrator VSA 7.0 9.1 - Authenticated Arbitrary File Upload !/usr/bin/ruby kazPwn.rb - Kaseya VSA v7 to v9.1 authenticated arbitrary file upload CVE-2015-6589 / ZDI-15-450 =================== by Pedro Ribeiro / Agile Information Security Disclosure date: 28/09/2015 Usage...

Kaseya Virtual System Administrator (VSA) 7.0 < 9.1 - (Authenticated) Arbitrary File Upload

!/usr/bin/ruby kazPwn.rb - Kaseya VSA v7 to v9.1 authenticated arbitrary file upload CVE-2015-6589 / ZDI-15-450 =================== by Pedro Ribeiro / Agile Information Security Disclosure date: 28/09/2015 Usage: ./kazPwn.rb https://:port execjs and mechanize gems are required to run this exploit...

[CVE-2015-2862/2863 / CERT VU#919604] Kaseya VSA arbitrary file download / open redirect

tl;dr Two vulns in Kaseya Virtual System Administrator - an authenticated arbitrary file download and two lame open redirects. Full advisory text below and at 1. Thanks to CERT for helping me to disclose these vulnerabilities 2. Multiple vulnerabilities in Kaseya Virtual System Administrator...

CVE-2015-2863

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-2862

CVE-2015-2862 affects Kaseya Virtual System Administrator (VSA). A directory traversal vulnerability allows remote authenticated users to read arbitrary files via a crafted HTTP request. Affected VSA versions are 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0....

CVE-2015-2863

Kaseya Virtual System Administrator (VSA) Open Redirect (CVE-2015-2863) affects VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4. An attacker can redirect users to arbitrary sites to facilitate phishing via unspecified vectors. Remediation per sources: app...

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)

Kaseya Virtual System Administrator VSA - Multiple Vulnerabilities 1 Multiple vulnerabilities in Kaseya Virtual System Administrator Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/...

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)

Multiple vulnerabilities in Kaseya Virtual System Administrator Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/ ========================================================================== Disclosure: 13/07/2015 / Last updated: 28/09/2015...

Kaseya Virtual System Administrator File Download / Open Redirect Vulnerabilities

Kaseya Virtual System Administrator suffers from arbitrary file download open redirection vulnerabilities. Two vulns in Kaseya Virtual System Administrator - an authenticated arbitrary file download and two lame open redirects. Full advisory text below and at 1. Thanks to CERT for helping me to...

Kaseya Patches Two Flaws in VSA IT Management Platform

A researcher has uncovered a pair of vulnerabilities in the Kaseya VSA IT management platform, including an open redirect that could be used to force users to visit an attacker-controlled sites. Kaseya VSA is a platform designed to handle a wide variety of IT management tasks, including audit,...

HP StoreVirtual 4000 and StoreVirtual VSA Software < 11.5 Multiple Vulnerabilities

The remote HP storage system, running HP StoreVirtual 4000 Storage and StoreVirtual VSA, is version 9.5.x or later but prior to 11.5. It is, therefore, affected by the following vulnerabilities : - An unspecified information disclosure vulnerability exists that allows a remote attacker to obtain...

Code injection

Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors...

CVE-2014-2606

Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors...

CVE-2014-2606

CVE-2014-2606 affects HP StoreVirtual 4000 Storage and StoreVirtual VSA, versions 9.5.x–11.0. The issue is a remote escalation of privileges by an authenticated remote user via unknown vectors, per the CVE description. The related HP security bulletin HPSBST03039 rev.1 documents remote disclosure...

CVE-2014-2926

CVE-2014-2926 affects Kaseya Virtual System Administrator (VSA) with kapfa.sys vulnerable to a NULL pointer dereference. Versions affected: VSA 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16. Local authenticated attackers could cause a denial of service (and, per CERT, potentially code execution in ...