CVE-2017-18362

What it actually does

Unauthenticated SQL injection in the ManagedIT.asmx endpoint permits arbitrary read and write SQL queries against the backend database with no authentication required.

Why it matters to the business

Attackers gain complete database control, enabling ransomware deployment across every managed endpoint; the vulnerability remains in CISA KEV with a 2022 remediation deadline and has been used in active ransomware campaigns.

How an attack unfolds

Threat actors locate the exposed ManagedIT.asmx page on the Kaseya VSA web interface and submit crafted requests that execute arbitrary SQL to exfiltrate credentials or directly download and run ransomware payloads on all managed systems.

How to fix it

Immediately restrict or disable public access to the ManagedIT.asmx page; apply any available vendor patches or upgrades; enforce network segmentation and web application firewall rules to block unauthenticated SQL injection attempts.

How to confirm the fix worked

Confirm the ManagedIT.asmx endpoint returns HTTP 401 or 403 for unauthenticated requests; retest with benign SQL payloads to verify injection is blocked; review database audit logs for anomalous query patterns.

Typical attack path

1. Discover the ManagedIT.asmx endpoint via network scanning or known VSA URLs
2. Send unauthenticated HTTP requests containing malicious SQL payloads
3. Execute read/write queries to obtain administrative access or trigger remote code execution
4. Deploy ransomware binaries to all endpoints managed by the VSA server

How to detect it

Search web server logs for unauthenticated requests to ManagedIT.asmx containing SQL keywords or unusual parameters; correlate with database audit logs showing bulk data access or command execution; look for ransomware process execution on managed endpoints following VSA activity.

• ManagedIT.asmx
• POST requests with SQL metacharacters to /ManagedIT.asmx
• Unexpected SQL queries selecting from credential or configuration tables
• Ransomware binaries launched from VSA-managed endpoint processes

What your security team should do

• Treat as critical due to active KEV ransomware exploitation and remediate before any other tasks
• Audit all VSA instances for exposure of the ManagedIT.asmx page
• Implement compensating controls such as WAF rules and network ACLs if patching is delayed
• Monitor for post-exploitation indicators including mass endpoint ransomware activity