------------------------------------------------------------------------
Authentication bypass in Kaseya VSA
------------------------------------------------------------------------
Kin Hung Cheng, Robert Hartshorn, May 2017

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A security vulnerability was found in Kaseya VSA that allows users to
view remote computers that they are not authorised to view. Using this
vulnerability a user that is authenticated to view at least one remote
computer can view ever machines in the Kaseya application.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on version R9.2

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Patch to the latest version of VSA.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20170504/authentication-bypass-in-kaseya-vsa.html

An authenticated user in Kaseya for viewing some remote computers can view every remote computer on the server. This is done via changing the URL to point to the remote computer that the person wants to view. As stated above, this issue should be present in all calls to the remote computer, but due to scope, we could not test every vector.

Steps to reproduce

-   Change the agentGuid in the URL