CVE-2017-18362 Kaseya VSA SQL Injection
Unauthenticated attackers can execute arbitrary SQL queries via the ManagedITSync integration, leading to database access and remote code execution.
- Exploited in the wild
- Since 24 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-18362?
CVE-2017-18362 is a critical SQL injection vulnerability in n/a, published on 5 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
Weakness: CWE-89
Which versions are affected by CVE-2017-18362?
It affects 1 product.
Products include Connectwise Manageditsync.
How do I fix CVE-2017-18362?
No fix has been published for CVE-2017-18362 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Jun 2022.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2017-18362 being exploited?
Yes. Attackers have exploited CVE-2017-18362 in the wild since at least 24 May 2022, including in ransomware campaigns.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-w35f-w5cg-jqhh.