Huntress Examines How Attackers May Have Obtained Kaseya VSA Agent GUIDs

Jul 20, 2021 · Original article ↗

Summary

Huntress examined the Kaseya VSA ransomware attack’s authentication bypass and why it affected a reported 50–60 MSPs. It found no confirmed explanation for how attackers obtained the Agent GUIDs needed to exploit the flaw.

Key points

The July 2021 REvil attack reportedly encrypted systems at 50–60 MSPs and their managed customers through Kaseya VSA.
Huntress describes an attack chain involving authentication bypass, arbitrary file upload and remote code execution.
A flaw in /dl.asp allowed access without a password when a valid Agent GUID was supplied; Huntress observed no failed attempts indicating GUID brute-forcing.
Huntress saw suspicious VSA procedure execution before Kaseya instructed customers to shut down on-premises servers, and says that shutdown would not have reduced compromises already underway.
Possible GUID sources include prediction, a newly registered rogue agent, a previously compromised VSA-managed host, other vulnerabilities or previously leaked information.
Huntress found a suspicious agent registered around 0100 ET, but lacked request contents or a packet capture to establish how it was used; the agent had been deleted from the database provided.
The researchers could not determine how attackers obtained the GUIDs and presented the proposed explanations as possibilities, not confirmed findings.

Article Details

Attack Vectors: The reported attack chain against Kaseya VSA consisted of an authentication bypass, arbitrary file upload, and remote code execution.
The authentication bypass involved submitting a valid Agent GUID without a password to the public-facing /dl.asp endpoint; the article reports no evidence of brute-forcing Agent GUIDs.
The article discusses possible ways attackers could have obtained Agent GUIDs, including a rogue agent, access to a host running a VSA agent, or information disclosure. These are presented as possibilities, not confirmed methods.
The article notes that SQL injection was not observed in the logs, though it could potentially have occurred before the incident or from different IP addresses.
Defensive Notes: Kaseya instructed customers to shut down on-premises VSA servers after recognizing the attack. The article says shutdowns after exploitation would not have reduced the number of already-compromised MSPs.
According to Kaseya, the SaaS platform was not vulnerable to the exploited vulnerabilities; its shutdown was a precautionary measure.