Unauthenticated Arbitrary File Upload RCE in Kaseya VSA 9.5.4.2149

An attacker can write arbitrary files with the permissions of the web-server process. By placing server-executable code in the web root, the attacker can execute code in the web-server context. This can compromise system confidentiality, integrity, and availability, enable credential theft, and potentially result in full system compromise.

If immediate patching is not possible, restrict or disable access to /SystemTab/uploader.aspx, especially from untrusted networks. Apply network ACLs, VPN-only access, reverse-proxy filtering, or WAF rules to block requests to the vulnerable endpoint and to detect suspicious use of PathData and qqfile parameters. Prevent execution of uploaded content by removing write permissions to the web root for the web server account and by disallowing execution of dynamic content from upload directories. Monitor for unexpected ASP/ASPX files, anomalous file creation under Kaseya web directories, and suspicious requests to newly created pages.

Upgrade Kaseya VSA to a fixed version provided by the vendor. The vulnerable uploader endpoint should enforce real authentication and authorization checks, validate session tokens correctly, restrict upload destinations to a safe allowlisted directory, prevent attacker control over filesystem paths, and block upload of server-executable content such as ASP/ASPX files. Review and reduce filesystem permissions for the web server process so it cannot write to the web root or other sensitive directories. Inspect systems for unauthorized uploaded files, especially web shells in web-accessible paths, and remove any malicious artifacts.