Quest response to Desktop Authority vulnerabilities (prior to 11.2) (4258779)

The Quest team has been made aware regarding vulnerabilities involving the KACE Desktop Authority product below:

CVE-2021-44028 – XXE vulnerability

CVE-2021-44029 – deserialization exploitation vulnerability

CVE-2021-44030 – XSS vulnerability

CVE-2021-44031 – directory traversal vulnerability

Quest takes the handling of vulnerabilities seriously, and we investigate and respond to all reported potential vulnerabilities. Our vulnerability reporting and response process can be found here.

CVE-2021-44028:

XXE can occur in Quest Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.

CVE-2021-44029:

This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.

CVE-2021-44030:

This vulnerability allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.

CVE-2021-44031:

/dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.

All CVEs above have been resolved in our 11.2 release of the KACE Desktop Authority product.