Unauthenticated RCE and Privilege Escalation in Kaseya VSA (CVE-2015-6922)

This repository contains a single Metasploit module (modules/exploits/windows/http/kaseya_uploader.rb) that exploits an arbitrary file upload vulnerability (CVE-2015-6922) in Kaseya VSA versions 7 through 9.1. The exploit targets the 'uploader.aspx' endpoint, allowing an unauthenticated attacker to upload a malicious ASP file to various potential directories on the server. Once uploaded, the ASP file (containing a Metasploit-generated payload) is executed, resulting in remote code execution with IUSR privileges. The module is weaponized, supporting customizable payloads and automatic cleanup. The code is written in Ruby and leverages Metasploit's HttpClient, EXE, and FileDropper mixins. The exploit is network-based, requiring access to the Kaseya VSA web interface, and attempts uploads to several common installation paths to maximize success. The repository is structured as a typical Metasploit exploit module, with all logic contained in a single file.

This repository contains a single Metasploit auxiliary module (modules/auxiliary/admin/http/kaseya_master_admin.rb) that exploits a vulnerability in Kaseya VSA (CVE-2015-6922) versions 7 through 9.1. The module abuses the /LocalAuth/setAccount.aspx endpoint, which is intended to be accessible only from localhost but lacks proper access controls. By sending crafted HTTP GET and POST requests, the module retrieves a session value and then submits attacker-supplied credentials to create a new Master Administrator account on the target Kaseya VSA instance. The exploit requires the attacker to specify the target URI and the desired credentials for the new account. Upon success, the module reports the creation of the new account and stores the credentials in the Metasploit credential database. The code is written in Ruby and is designed to be run within the Metasploit Framework.