CVE-2015-6589
HIGHKaseya VSA <=9.1.0.8 Authenticated Path Traversal & Arbitrary File Write via json.ashx
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2015-6589. PoCs published by Pedro Ribeiro.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Kaseya VSA, including unauthenticated privilege escalation and remote code execution via file upload with directory traversal. It includes a Ruby script for authenticated arbitrary file upload (CVE-2015-6589) and references Metasploit modules for unauthenticated exploits (CVE-2015-6922).
Description
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
Exploits (2)
This exploit demonstrates multiple vulnerabilities in Kaseya VSA, including unauthenticated privilege escalation and remote code execution via file upload with directory traversal. It includes a Ruby script for authenticated arbitrary file upload (CVE-2015-6589) and references Metasploit modules for unauthenticated exploits (CVE-2015-6922).
This Ruby script exploits CVE-2015-6589, an authenticated arbitrary file upload vulnerability in Kaseya VSA versions 7.0.0.0 to 9.1.0.8. It authenticates using a challenge-based password hashing mechanism, then uploads a shell file to a vulnerable endpoint.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H