Horizon Alert
Summary of the vulnerability and why it matters
The ConnectWise ManagedITSync integration for Kaseya VSA contains a weakness that allows unauthenticated remote commands. This vulnerability can provide full, direct access to the Kaseya VSA database. Attackers have exploited this flaw to deploy ransomware on endpoints managed by the affected server.
- Vulnerable integration component
- Unauthenticated database access
- Widespread ransomware deployment
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could gain direct database access to a Kaseya VSA server through the ConnectWise ManagedITSync integration. This access allows for arbitrary SQL queries, enabling attackers to read or write data. In known campaigns, this vulnerability was exploited to deploy ransomware on managed endpoints.
- Vulnerable integration is exposed externally.
- Attacker sends unauthenticated SQL queries.
- Commands execute, impacting systems and data.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to gain full access to a Kaseya VSA database. This could lead to the execution of arbitrary SQL queries, potentially resulting in the compromise of sensitive data and the deployment of malicious payloads like ransomware on managed endpoints. The exploitation of this vulnerability has been observed in active campaigns.
- Likely attacker skill level: Low
- Required access or conditions: Network access
- Business risk or urgency: High
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability allows unauthenticated remote commands, granting direct access to the Kaseya VSA database. Attackers have exploited this to deploy ransomware on managed endpoints. Organizations with the ManagedIT.asmx page accessible via the Kaseya VSA web interface are at risk of arbitrary SQL queries, leading to potential data compromise and system control.
- Find assets with the affected integration.
- Restrict access to the integration's web interface.
- Address the vulnerability and monitor systems.
