------------------------------------------------------------------------
Code execution in Kaseya VSA
------------------------------------------------------------------------
Kin Hung Cheng, Robert Hartshorn, May 2017

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A security vulnerability was found in Kaseya VSA file upload file
functionality. Using this vulnerability an authenticated user in a
Kaseya VSA environment is able to upload arbitrary files onto the
server. This functionality can lead to remote code execution with an asp
shell.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on version 9.2

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Patch to the latest version of VSA.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20170503/code-execution-in-kaseya-vsa.html

An authenticated user is able to upload a file to the remote computer. This is done via uploading to a folder on the server, then the server sends it to the remote computer. The server is vulnerable to uploading arbitrary files, inducing custom ASP or ASPX script and executing it from the upload directory as there is no protection around file types uploaded, or ability to read from the upload directory.

Steps to reproduce

-   Go to the file manager or aDocumentsa of a machine
-   Upload an ASPX shell
-   Example shell: cmdasp.aspx
a   cmd.aspx is a basic asp command shell
-   Open the script in a new tab
-   Code execution