CISA adds dozens of vulnerabilities to catalog of exploited bugs

An unauthenticated SQL injection (CWE-89) exists in the ConnectWise ManagedITSync integration (through 2017) for Kaseya Virtual System Administrator (VSA), triggered through the ManagedIT.asmx page of the VSA web interface. Any unauthenticated attacker who can reach that page over the network can submit arbitrary SQL queries, both read and write, gaining full direct access to the VSA database and effectively running remote commands on the server. Because VSA servers centrally manage endpoints for managed service providers, compromise can cascade downstream: in February 2019 attackers actively exploited this flaw to download and execute ransomware payloads on all endpoints managed by affected VSA servers. Organizations are affected if they run Kaseya VSA with the ManagedITSync integration enabled and the ManagedIT.asmx page reachable by untrusted users. Exploitation is confirmed in the wild (CISA KEV, added 2022-05-24; known ransomware use), EPSS estimates an 86.8% probability of exploitation within 30 days, and CISA notes the impacted product is end-of-life.

Do: Because CISA notes the impacted product is end-of-life, disconnect or decommission any Kaseya VSA still running the ConnectWise ManagedITSync integration; otherwise update the integration beyond the 2017 version or disable it and remove public network access to the ManagedIT.asmx page of the VSA web interface. Restrict the VSA web interface to trusted networks and check managed endpoints for signs of the February 2019 ransomware exploitation.

CVE-2020-0638 is a local elevation of privilege flaw in the way Microsoft's Update Notification Manager handles files (CWE-59, a link-following/race-condition class of bug), affecting Windows 10 versions 1709, 1803, 1809, 1903 and 1909, plus Windows Server 1803, 1903, 1909 and 2019. To trigger it, an attacker must first gain code execution on the victim system with limited privileges; no user interaction is required after that initial foothold. Successful exploitation allows the attacker to elevate privileges with high impact on confidentiality, integrity and availability, making it a useful step in ransomware and other intrusion chains to take full control of a host. Microsoft fixed the issue in its January 2020 Patch Tuesday security updates. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-05-23 with known ransomware use, confirming exploitation in the wild; no public proof-of-concept is known.

Do: Apply Microsoft's January 2020 security updates (or any later cumulative update) to all affected Windows 10 and Windows Server systems, prioritizing user workstations and servers where an attacker with an existing foothold would matter; federal agencies must patch per CISA KEV/BOD 22-01 timelines. Inventory endpoints still running Windows 10 builds 1709–1909 and Windows Server 1803/1903/1909/2019 and verify the installed cumulative update level. Because exploitation requires prior code execution, pair patching with EDR and least-privilege controls to disrupt ransomware chains.