CVE-2021-30120

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Kaseya VSA antes de la versión 9.5.7 permite a los atacantes eludir el requisito de 2FA. La necesidad de usar 2FA para la autenticación en la aplicación del lado del cliente en lugar del lado del servidor y puede ser evadida usando un proxy local. De este modo, se hace inútil la 2FA. Descripción detallada --- Durante el proceso de inicio de sesión, después de que el usuario se autentique con nombre de usuario y contraseña, el servidor envía una respuesta al cliente con los booleanos MFARequired y MFAEnroled. Si el atacante ha obtenido la contraseña de un usuario y ha utilizado un proxy de intercepción (por ejemplo, Burp Suite) para cambiar el valor de MFARequered de True a False, no se solicita el segundo factor, pero el usuario sigue conectado