CVE-2021-30116

What is Kaseya VSA?

Kaseya Virtual System/Server Administrator (VSA) is an IT management platform used primarily by Managed Service Providers (MSPs) to remotely monitor, manage, and patch client endpoints. VSA agents run on client machines and communicate back to the central VSA server, which MSPs use to deploy software, push policies, and execute scripts across all managed devices simultaneously. This architecture makes VSA a "single pane of glass" attacker target: compromising the VSA server grants access to push commands to every endpoint managed by the MSP — potentially thousands of client machines across dozens of customer organizations.

Overview

CVE-2021-30116 is an information disclosure vulnerability (CWE-522) in Kaseya VSA that allows unauthenticated attackers to extract session IDs from the VSA web interface. The disclosed session IDs can then be used to bypass authentication and gain administrative access to the VSA server without valid credentials. This vulnerability was one of several used by REvil ransomware group in the July 4, 2021 weekend attack — the largest single ransomware event in history at the time. REvil compromised approximately 60 Kaseya MSP customers and, through those MSPs, encrypted systems at roughly 1,500 downstream business organizations. REvil initially demanded $70 million for a universal decryptor. The attack was a zero-day: DIVD researchers had discovered the vulnerabilities and were coordinating disclosure with Kaseya when REvil attacked before the patch was ready.

Affected Versions

Technical Details

The Kaseya VSA web interface includes authentication and session management code that improperly exposes session identifiers:

• Root cause: Insufficiently protected credentials (CWE-522) — the VSA web application discloses session ID tokens in responses accessible to unauthenticated users
• Authentication bypass: The extracted session IDs can be replayed to authenticate as a VSA administrator without knowing the administrator's password
• Attack chain: REvil combined CVE-2021-30116 with additional VSA vulnerabilities (authentication bypass and SQL injection flaws discovered by DIVD) to gain full administrative access, then used VSA's legitimate software deployment capability to push the Sodinokibi/REvil ransomware to all managed endpoints
• Scope: Changed — the attack crosses security boundaries: VSA access enables command execution on all VSA agent-managed endpoints, which are in separate customer networks
• CVSS 10.0 reflects the maximum possible impact given the supply-chain nature: one server compromised, thousands of downstream machines affected

Discovery

Discovered by Wietse Boonstra and researchers at the Dutch Institute for Vulnerability Disclosure (DIVD). DIVD notified Kaseya and was coordinating responsible disclosure when REvil exploited the vulnerabilities as a zero-day attack on July 2, 2021 — before the patch was complete.

Exploitation Context

The July 4, 2021 REvil attack is one of the most significant ransomware events in history. REvil targeted the July 4 US holiday weekend deliberately to maximize impact while IT staff were unavailable. By attacking MSPs rather than individual companies, REvil multiplied their reach: each compromised MSP gave access to dozens of client organizations. The $70 million ransom demand was the largest ever at the time. The attack prompted CISA and the FBI to issue emergency guidance. Kaseya ultimately obtained a universal decryptor key through an undisclosed third party (later reported to be the FBI, which obtained the key from a server it had accessed) and distributed it without paying the ransom.

Remediation

1. Upgrade Kaseya VSA to version 9.5.7a or later immediately
2. If immediate patching is not possible, shut down the VSA server and take it offline — Kaseya's emergency recommendation was to power off all on-premises VSA servers
3. Review VSA audit logs for unauthorized administrative sessions, policy changes, and software deployment events
4. Audit all managed endpoints for ransomware artifacts or unauthorized software deployment using the VSA deployment feature
5. After patching, rotate all VSA administrative credentials
6. Implement IP allowlisting for VSA web interface access — restrict to known administrator IP ranges
7. Consider network segmentation to limit what VSA agent-managed machines can access within client networks, reducing lateral movement potential if VSA is compromised