CVE-2017-18362: Kaseya VSA SQL Injection Vulnerability

CVE-2017-18362 is a SQL injection vulnerability in Kaseya Virtual System/Server Administrator (VSA), specifically involving the ConnectWise ManagedITSync integration. It allows unauthenticated remote commands that grant full direct access to the Kaseya VSA database. This matters because VSA is commonly used for remote monitoring and management; database access can expose credentials, configurations, and managed endpoints, and the issue has known ransomware use. The impacted product is end-of-life.

IT and security teams should treat any remaining instances as high priority for discovery and isolation. Confirm all technical details against the vendor advisory, as public specifics on exact builds and configurations are limited.

How it works

This flaw falls under CWE-89 (SQL Injection). In this class of weakness, untrusted input reaches a database query without proper sanitization or parameterization, letting an attacker alter the intended SQL logic.

According to the CISA summary, the ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands. An attacker who can reach the affected interface can issue crafted requests that result in full direct access to the Kaseya VSA database. That access can support reading or modifying data, creating accounts, or otherwise abusing the management platform. Exact request formats and exploit mechanics are not detailed here; treat any internet- or network-exposed VSA instance with this integration as potentially abusable and verify behavior against the vendor advisory.

Am I affected? How to find it in your systems

Kaseya VSA typically runs as an on-premises or hosted remote monitoring and management (RMM) server used by MSPs and internal IT teams to administer endpoints. Inventory steps:

• Search asset management, CMDB, and software inventory for “Kaseya VSA,” “Virtual System Administrator,” or related ConnectWise ManagedITSync components.
• Identify servers listening on VSA management ports or hosting the VSA web/application tier; check whether the ManagedITSync integration is or was enabled.
• Review installation directories, service names, and configuration files that reference Kaseya or the integration; confirm version and patch level against the vendor advisory because exact affected ranges are not restated here.
• Scan internal and external attack surface for exposed VSA consoles; prioritize any instance reachable without strong network controls.

Telemetry and log signs of exploitation (general for this class): unusual or unauthenticated requests hitting integration or database-related endpoints; spikes in SQL errors or anomalous query patterns in application/database logs; unexpected administrative account creation or bulk data access from the VSA host; outbound connections or ransomware-related activity originating from managed endpoints after VSA compromise. Correlate with EDR/SIEM alerts for credential dumping or lateral movement from the VSA server.

How to remediate

CISA states the impacted product is end-of-life and should be disconnected if still in use. That is the primary remediation path: decommission the affected Kaseya VSA instance and the ConnectWise ManagedITSync integration rather than attempting prolonged operation.

• If a supported migration path or replacement product exists from the vendor, follow the official upgrade/migration guidance and confirm the new platform is not vulnerable to the same class of issue.
• After disconnection, rotate any credentials, API keys, or agent secrets that resided in or were managed by the VSA database.
• Harden remaining RMM tooling: enforce least privilege, require strong authentication, keep integrations minimal, and ensure all database access uses parameterized queries and least-privilege DB accounts (standard defenses against CWE-89).

Do not rely on partial configuration tweaks alone; end-of-life status means ongoing vendor fixes should not be expected. Confirm final disposition steps with the vendor advisory.

If you can't patch immediately

Because the product is end-of-life, “patch later” is not a viable long-term plan. Until full disconnection:

• Segment the VSA host strictly: place it on an isolated management VLAN with deny-by-default firewall rules; allow only necessary admin jump-host access and block general internet ingress/egress.
• Disable or remove the ConnectWise ManagedITSync integration if it can be turned off without breaking critical operations; reduce the attack surface of any remaining integration endpoints.
• Apply virtual patching where feasible (WAF or reverse-proxy rules that block anomalous input patterns typical of SQL injection), understanding this is incomplete protection for unauthenticated database access.
• Increase monitoring: alert on unauthenticated access attempts, unusual SQL activity, new admin sessions, and any ransomware indicators on the VSA server and its managed estate.
• Prepare accelerated decommission and credential rotation plans so exposure window stays minimal.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, frequently lead to data theft and follow-on extortion. If this VSA instance was reachable and unpatched, assume the database and managed systems may have been accessed. Rotate secrets, review accounts and agent configurations, and investigate for persistence or ransomware staging. You can run a free exposure scan of your email addresses against known breach data to check whether associated credentials or identities have appeared in public breach corpora, then proceed with broader incident response as needed.