{"id":"CVE-2017-18362","kind":"vulnerability","aliases":["CVE-2017-18362"],"related":[],"title":"Kaseya Virtual System/Server Administrator (VSA): Kaseya VSA SQL Injection Vulnerability","description":"ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.","summary":"Unauthenticated SQL injection in the ConnectWise ManagedITSync integration (ManagedIT.asmx) for on-premises Kaseya VSA. Anyone who can reach the page can read and write the VSA database, which lets them create admin users or push tasks to every managed endpoint. Exploited in the wild since Feb 2019 to deploy GandCrab ransomware. In CISA KEV.","severity":"critical","cvss":9.8,"epss":0.8682,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Kaseya Virtual System/Server Administrator (VSA)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ConnectWise ManagedITSync integration for Kaseya VSA","fixed":[],"affected":"<= 2017 (NVD CPE, all versions up to and including 2017)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["connectwise","end-of-life","exploited","kaseya-vsa","msp","ransomware","self-hosted","vendor"],"not_affected_if":["cloud-hosted","integration-not-installed","managed-hosting","managedtitsync-integration-not-used","vsa-not-deployed"],"how_to_check":"On the VSA server, look for 'ConnectWise MSP Kaseya Web Service' in Add or Remove Programs, or for the file ManagedIT.asmx. Or browse to https://<vsa-host>/kaseyacwwebservice/managedit.asmx; if the page loads, you are exposed. Snort SID 1:60119 detects exploit attempts against /KaseyaCwWebService/ManagedIT.asmx. Kaseya once published a checker tool, which I could not retrieve.","fix":"Disconnect the VSA server from the internet and audit it for rogue admin accounts and tasks. Remove ManagedITSync and reinstall only the current ConnectWise-patched version, or drop the integration. CISA's required action: the product is end-of-life, so disconnect it if still in use (KEV added 2022-05-24, due 2022-06-14). No fixed version number is published in the sources I read.","status":"open","published_at":"2019-02-05T06:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:46+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:15:46Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the impacted product if it is still in use, as CISA directs, because the product is end-of-life; the sources do not name a patched version.\nunknown","reach":"internet","impact":"high","summary":"Kaseya VSA, an IT remote management server, has an SQL injection flaw in its ConnectWise ManagedITSync integration that lets unauthenticated attackers send commands and gain full access to the VSA database. CISA lists it as actively exploited, with ransomware use noted in the sources.","category":"vendor","who_cares":["kaseya-vsa","msp","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and changes the full VSA database without logging in","analyst_note":"Find the vendor's end-of-life notice and any mitigation for ManagedITSync, and check the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362) for the due date and exact affected versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["vsa-not-deployed","managedtitsync-integration-not-used"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2878,"output_tokens":449,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor's end-of-life notice and any mitigation for ManagedITSync, and check the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362) for the due date and exact affected versions.","search":"'-18362':13A,16A '-2017':12A,15A '2017':102C '2019':90B,124C 'abl':166C 'access':116C,161C 'activ':127C 'admin':75B 'administr':4A 'administrator':20A 'allow':113C 'anyon':58B,159C 'arbitrari':169C 'attack':125C 'authent':177C 'avail':152C 'cisa':96B 'command':111C 'connectwis':28B,48B,98C 'connectwise':22A 'creat':74B 'cve':11A,14A 'databas':70B,121C 'deploy':92B 'direct':115C 'download':134C 'end':30B 'end-of-lif':29B 'endpoint':83B,141C 'everi':81B 'execut':136C 'exploit':33B,84B,128C 'feb':89B 'februari':123C 'for':25A 'full':114C 'gandcrab':93B 'host':41B 'inject':9A,45B 'integr':50B,100C 'integration':24A 'interfac':158C 'kaseya':1A,6A,17A,26A,35B,56B,104C,119C,155C 'kaseya-vsa':34B 'kev':97B 'let':72B 'life':32B 'manag':82B,142C 'managedit.asmx':51B,149C 'manageditsync':23A,49B,99C 'msp':37B 'on-premis':53B 'page':63B,150C,164C 'payload':138C 'premis':55B 'push':78B 'queri':171C 'ransomwar':38B,94B,137C 'reach':61B 'read':65B,173C 'remot':110C 'run':168C 'self':40B 'self-host':39B 'server':146C 'sinc':88B 'sql':8A,44B,170C 'system/server':3A,19A 'task':79B 'unauthent':43B,109C 'user':76B 'vendor':42B 'via':153C 'virtual':2A,18A 'vsa':5A,7A,21A,27A,36B,57B,69B,105C,120C,145C,156C 'vulner':10A,107C 'web':157C 'wild':87B,132C 'without':176C 'write':67B,175C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-02-05T06:29:00+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2017-18362","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2017-18362","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-18362","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2017-18362:45","url":null,"severity":null,"published_at":"2026-10-23T21:16:22+00:00","modified_at":"2026-10-23T21:16:22+00:00","first_seen_at":"2026-10-23T21:16:22+00:00","fetched_at":"2026-10-23T21:16:22+00:00","note":"Read NVD with the CISA KEV entry and the Huntress writeup. Kaseya's own advisory (helpdesk article 360022495572) is dead and I could not fetch it. No vendor EOL notice or fixed version found. Public PoC is kbni/owlky. Severity left critical (CVSS 3.1 9.8, exploited, KEV)."},{"source":"nvd","external_id":"CVE-2017-18362","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18362","severity":null,"published_at":"2019-02-05T06:29:00+00:00","modified_at":"2026-08-13T05:17:15+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":919,"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18362","title":"NVD CVE-2017-18362 (incl. CISA KEV entry)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":920,"url":"https://www.huntress.com/blog/cve-2017-18362-arbitrary-sql-injection-in-mangeditsync-integration-ba142ff24f4d","title":"Huntress: Arbitrary SQL Execution in ManagedITSync Integration","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":921,"url":"https://github.com/kbni/owlky","title":"kbni/owlky PoC for ManagedITSync","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}