CVE-2021-30119

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.7

Description The issue is related to an authenticated reflective Cross Site Scripting (XSS) attack. Specifically, the result parameter of the /HelpDeskTab/rcResults.asp endpoint and the FileName parameter of the /done.asp endpoint are insecurely returned in the requested web page, allowing for XSS attacks. For example, an attacker could use the endpoint /HelpDeskTab/rcResults.asp with a malicious result parameter, such as <script>alert(document.cookie)</script>, to execute a Cross Site Scripting attack. Similarly, the /done.asp endpoint is vulnerable with a crafted FileName parameter.

Recommendations For versions prior to 9.5.7, update to version 9.5.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the /HelpDeskTab/rcResults.asp and /done.asp endpoints until a patch is applied. Avoid using the result parameter in the /HelpDeskTab/rcResults.asp endpoint and the FileName parameter in the /done.asp endpoint until the issue is resolved.