Information Disclosure in Kaseya VSA (CVE‑2021‑30116) Exposes Session IDs
What It Is
Kaseya Virtual System/Server Administrator (VSA) contains an information‑disclosure flaw that allows an unauthenticated attacker to retrieve a valid sessionId value from the web interface. Possession of this identifier can be leveraged to hijack an authenticated session and execute further actions on the managed system.
Exploitability
- No public proof‑of‑concept has been released, and there is no confirmed active exploitation in the wild.
- The vulnerability is rated Medium (CVSS ≈ 6.5) by NVD, reflecting the risk that a stolen session token can lead to privileged actions.
Affected Products
- Vendor: Kaseya
- Product: Virtual System/Server Administrator (VSA) – all supported versions prior to the vendor‑issued fix (see Kaseya advisory for exact patch levels).
Why It Matters for Compliance & Audit Readiness
Session identifiers are a core element of access‑control and identity‑management controls. An undisclosed session token undermines the integrity of authentication logs, weakens evidence of due‑diligence, and can break the audit trail required for standards such as NIST CSF, ISO 27001, and SOC 2. Mapping this flaw to the “Session Management” control (e.g., NIST AC‑2, ISO A.9.2) and documenting remediation steps provides a defensible posture for continuous‑control monitoring and future audits.
Recommended Actions
- Patch Immediately: Apply Kaseya’s security update that masks or regenerates session IDs.
- Rotate Sessions: Force a global logout and require re‑authentication for all active users.
- Log Review: Search recent VSA logs for anomalous session‑ID usage or unexpected IP sources.
- Strengthen Controls: Enforce MFA for VSA access, restrict VSA network exposure to trusted IP ranges, and map the fix to your access‑control policy in the Trust Center.
- Document Evidence: Capture patch deployment records, session‑rotation timestamps, and updated firewall rules as audit‑ready artifacts.
Source: CISA KEV – CVE‑2021‑30116