CVE-2013-10034: 
Kaseya VSA Server vulnerability analysis and mitigation

CVE-2013-10034 is an unrestricted file upload vulnerability in Kaseya KServer versions prior to 6.3.0.2, affecting the uploadImage.asp endpoint. The flaw allows unauthenticated remote attackers to upload files with arbitrary extensions (including .asp) to web-accessible directories, enabling remote code execution. Although the vulnerability originates from 2013, it was formally assigned a CVE and published in July 2025. It carries a CVSS v4.0 base score of 9.3 (Critical) (Red Hat CVE, VulnCheck).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The uploadImage.asp endpoint accepts multipart/form-data POST requests without requiring authentication and performs no validation on the filename parameter, allowing an attacker to specify an arbitrary path and file extension. By uploading a .asp web shell to a web-accessible directory, the attacker can subsequently invoke it via HTTP to execute arbitrary server-side code. The vulnerability was resolved in version 6.3.0.2 by completely removing the vulnerable endpoint. A public Metasploit module and Exploit-DB entry exist for this vulnerability (VulnCheck, Exploit-DB, Metasploit Module).

Successful exploitation grants an unauthenticated attacker remote code execution on the Kaseya KServer host, with code running under the privileges of the IUSR account. This can lead to full system compromise, unauthorized access to managed endpoints (since Kaseya VSA is an IT management platform with broad network reach), data exfiltration, and potential lateral movement across all systems managed by the affected KServer instance (VulnCheck, Red Hat CVE).

A public Metasploit module (exploits/windows/http/kaseya_uploadimage_file_upload) and an Exploit-DB entry (ID 29675) are available, making exploitation straightforward and accessible to low-skilled attackers. No authentication is required, and the attack can be executed remotely over the network with low complexity. The EPSS score is approximately 0.618%, and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Exploit-DB, Metasploit Module, VulnCheck).

1. Reconnaissance: Identify internet-facing Kaseya KServer instances running versions prior to 6.3.0.2 using tools like Shodan (search for Kaseya VSA login pages) or by directly probing the target URL.
2. Confirm vulnerability: Send a test HTTP GET or HEAD request to http://<target>/uploadImage.asp to confirm the endpoint exists and is accessible without authentication.
3. Craft malicious upload request: Construct a multipart/form-data POST request to http://<target>/uploadImage.asp, setting the filename parameter to a path within a web-accessible directory with an .asp extension (e.g., ../../webpages/shell.asp).
4. Upload web shell: Include a simple ASP web shell as the file body (e.g., <% Response.Write(CreateObject("WScript.Shell").Exec(Request("cmd")).StdOut.ReadAll()) %>) in the POST request body.
5. Execute arbitrary commands: Send an HTTP GET request to http://<target>/shell.asp?cmd=whoami (or the path where the shell was uploaded) to trigger execution of arbitrary OS commands under the IUSR account.
6. Establish persistence/lateral movement: Use the shell to deploy additional payloads, create new accounts, or pivot to managed endpoints via Kaseya's agent infrastructure (Exploit-DB, Metasploit Module, VulnCheck).

• Network: Unexpected HTTP POST requests to /uploadImage.asp from external or untrusted IP addresses; subsequent GET requests to newly created .asp files in web-accessible directories.
• File System: Presence of unexpected .asp files (especially with names like shell.asp, cmd.asp, or random strings) in Kaseya web directories (e.g., webpages/ or similar).
• Logs: IIS access logs showing POST requests to uploadImage.asp with unusual filename parameters containing path traversal sequences (../) or .asp extensions; subsequent GET requests to those uploaded files.
• Process: Unusual child processes spawned by the IIS worker process (w3wp.exe), such as cmd.exe, powershell.exe, or wscript.exe, running under the IUSR account.

The primary remediation is to upgrade Kaseya KServer to version 6.3.0.2 or later, which removes the vulnerable uploadImage.asp endpoint entirely. If immediate upgrade is not possible, restrict network access to the Kaseya web interface using firewall rules to allow only trusted IP addresses. Additionally, implement web application firewall (WAF) rules to block POST requests to uploadImage.asp, enforce strict file upload validation at the perimeter, and monitor IIS logs for suspicious upload activity (VulnCheck, Red Hat CVE).