CVE-2021-30120 2FA bypass in Kaseya VSA <= v9.5.6

What is CVE-2021-30120?

CVE-2021-30120 is a critical authentication bypass vulnerability in n/a, published on 9 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Weakness: CWE-669

Which versions are affected by CVE-2021-30120?

It affects 1 product.

Products include Kaseya Vsa.

How do I fix CVE-2021-30120?

No fix has been published for CVE-2021-30120 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-30120 being exploited?

There is no known exploitation of CVE-2021-30120 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-30117 Authenticated SQL injection in Kaseya VSA < v9.5.6 Critical 9.8
• CVE-2021-30118 Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5 Critical 9.8
• CVE-2021-30201 Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6 High 7.5
• CVE-2019-14510 Hardcoded credentials in n/a Medium 6.7
• CVE-2021-30121 (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6 Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6j9-rwx4-qcj3.