Description Preview
CVE-2021-30119 is an authenticated cross-site scripting (XSS) vulnerability affecting Kaseya VSA. The vulnerability exists in two locations: the "result" parameter in HelpDeskTab/rcResults.asp and the "FileName" parameter in done.asp. In both cases, user-supplied input is insecurely returned in the web page response without proper sanitization, allowing attackers to inject and execute malicious JavaScript code in the context of the victim's browser session.
Overview
This vulnerability is a reflective XSS issue (CWE-79) in Kaseya VSA that could allow authenticated attackers to execute arbitrary JavaScript code in a victim's browser. When exploited, attackers can potentially steal session cookies, access sensitive information, or perform actions on behalf of the victim user. The vulnerability affects two specific endpoints:
- The "result" parameter in /HelpDeskTab/rcResults.asp
- The "FileName" parameter in /done.asp
Both parameters reflect user input without proper encoding or sanitization, allowing script injection. This vulnerability was part of a larger set of issues discovered in Kaseya VSA by the Dutch Institute for Vulnerability Disclosure (DIVD).
Remediation
To remediate this vulnerability:
- Update to the latest version of Kaseya VSA that contains patches for this vulnerability.
- Implement proper input validation and output encoding for all user-supplied data.
- Consider implementing Content Security Policy (CSP) headers to mitigate XSS attacks.
- Regularly audit web applications for security vulnerabilities, particularly focusing on input validation and output encoding.
- Monitor for suspicious activities that might indicate exploitation attempts.
For temporary mitigation if patching is not immediately possible:
- Limit access to the affected pages to only necessary users
- Implement web application firewall rules to block requests containing suspicious script patterns
References
- DIVD Limited Disclosure: https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- DIVD CVE-2021-30119 Details: https://csirt.divd.nl/CVE-2021-30119
- DIVD Case DIVD-2021-00011: https://csirt.divd.nl/DIVD-2021-00011
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
