{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "credits": [{"lang": "en", "value": "Discovered by Wietse Boonstra of DIVD"}], "descriptions": [{"lang": "en", "value": "Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-04T06:25:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://csrit.divd.nl/DIVD-2021-00011"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://csrit.divd.nl/CVE-2021-30120"}], "solutions": [{"lang": "en", "value": "Upgrade to a version above 9.5.6"}], "source": {"advisory": "DIVD-2021-00011", "discovery": "INTERNAL"}, "title": "2FA bypass in Kaseya VSA <= v9.5.6", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-30120", "STATE": "PUBLIC", "TITLE": "2FA bypass in Kaseya VSA <= v9.5.6"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Discovered by Wietse Boonstra of DIVD"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/", "refsource": "CONFIRM", "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"}, {"name": "https://csrit.divd.nl/DIVD-2021-00011", "refsource": "CONFIRM", "url": "https://csrit.divd.nl/DIVD-2021-00011"}, {"name": "https://csrit.divd.nl/CVE-2021-30120", "refsource": "CONFIRM", "url": "https://csrit.divd.nl/CVE-2021-30120"}]}, "solution": [{"lang": "en", "value": "Upgrade to a version above 9.5.6"}], "source": {"advisory": "DIVD-2021-00011", "discovery": "INTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-30120", "datePublished": "2021-07-09T13:22:17", "dateReserved": "2021-04-02T00:00:00", "dateUpdated": "2022-04-04T06:25:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*", "matchCriteriaId": "13B1AE73-6472-40B0-914E-4EB9A4C7270D", "versionEndIncluding": "9.5.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in."}, {"lang": "es", "value": "Kaseya VSA antes de la versi\u00f3n 9.5.7 permite a los atacantes eludir el requisito de 2FA. La necesidad de usar 2FA para la autenticaci\u00f3n en la aplicaci\u00f3n del lado del cliente en lugar del lado del servidor y puede ser evadida usando un proxy local. De este modo, se hace in\u00fatil la 2FA. Descripci\u00f3n detallada --- Durante el proceso de inicio de sesi\u00f3n, despu\u00e9s de que el usuario se autentique con nombre de usuario y contrase\u00f1a, el servidor env\u00eda una respuesta al cliente con los booleanos MFARequired y MFAEnroled. Si el atacante ha obtenido la contrase\u00f1a de un usuario y ha utilizado un proxy de intercepci\u00f3n (por ejemplo, Burp Suite) para cambiar el valor de MFARequered de True a False, no se solicita el segundo factor, pero el usuario sigue conectado"}], "id": "CVE-2021-30120", "lastModified": "2022-07-12T17:42:04.277", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2021-07-09T14:15:07.903", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"}, {"source": "cve@mitre.org", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://csrit.divd.nl/CVE-2021-30120"}, {"source": "cve@mitre.org", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://csrit.divd.nl/DIVD-2021-00011"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}