what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Kaseya VSA 6.5.0.0 XSS / Brute Force

Kaseya VSA 6.5.0.0 XSS / Brute Force
Posted Apr 4, 2017
Authored by Patrick Webster

Kaseya VSA version 6.5.0.0 suffers from cross site scripting and brute forcing vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | 7fe218cd1c415fe7ecf706fc430277ad0a16b68a9d7aa68e327097eb8897004b

Kaseya VSA 6.5.0.0 XSS / Brute Force

Change Mirror Download
https://www.osisecurity.com.au/kaseya-parameter-reflected-xss-enumeration-and-bruteforce-weakness.html

Date:
04-Apr-2017

Software:
Kaseya

Affected version:
Kaseya VSA v6.5.0.0.

Vulnerability details:

1. The "forgot password" function at https://[target]/access/logon.asp
reveals whether a username is valid/exists or not, which assists with
brute force attacks. An incorrect username responds with aNo record of
this user existsa, where a valid username returns aThe system emailed
you a link. Visit it to change your password.a

This makes it much easier to brute force accounts.

2. The password reset URL, such as
https://[target]/access/resetAccount.asp?id=26756180, is not
significantly complex to prevent brute force attacks. The software
should use a GUID (5.3A10^36 combinations) globally unique value
instead to prevent brute force. The server response permits data
matching to ascertain whether a guessed id value is valid or not.

3. The URL at https://[target]/access/accessRoot.asp?page=logon.asp
contains a cross-site scripting vulnerability. Authentication cookies
may be stolen or malicious HTML or JavaScript etc injected to abuse
the client web browser.

Examples:

https://[target]/access/accessRoot.asp?page=http://www.osisecurity.com.au/
https://[target]/access/accessRoot.asp?page=javascript:alert(document.cookie);/


References:
http://help.kaseya.com/webhelp/EN/RN/index.asp#30773.htm

Credit:
Vulnerability discovered by Patrick Webster

Disclosure timeline:

20-Aug-2014 - Discovered during audit.
24-Aug-2014 -Sent to vendor.
25-Aug-2014 - Vendor response.
15-Oct-2014 - Vendor partially patched. Additional fixes due in 2
weeks. version 6.5.0.22+.
04-Apr-2017 - Public disclosure.

About OSI Security:

OSI Security is an independent network and computer security auditing
and consulting company based in Sydney, Australia. We provide internal
and external penetration testing, vulnerability auditing and wireless
site audits, vendor product assessments, secure network design,
forensics and risk mitigation services.

We can be found at http://www.osisecurity.com.au/
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    11 Files
  • 8
    Dec 8th
    36 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close