CVE-2022-29847
📋 TL;DR
This vulnerability allows unauthenticated attackers to invoke an API transaction that relays encrypted WhatsUp Gold user credentials to arbitrary hosts. It affects Progress Ipswitch WhatsUp Gold versions 21.0.0 through 21.1.1 and 22.0.0, potentially exposing sensitive authentication data.
💻 Affected Systems
- Progress Ipswitch WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could capture encrypted credentials, potentially decrypt them, and gain unauthorized access to WhatsUp Gold systems, leading to network monitoring compromise and lateral movement.
Likely Case
Attackers intercept encrypted credentials, which may be decrypted depending on encryption strength, leading to unauthorized access and potential privilege escalation.
If Mitigated
With proper network segmentation and access controls, impact is limited to credential exposure without successful decryption or system access.
🎯 Exploit Status
The vulnerability requires no authentication and involves simple API calls, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.1.2 and 22.0.1
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
Restart Required: Yes
Instructions:
1. Download the patch from Progress support portal. 2. Backup current installation. 3. Apply the patch following vendor instructions. 4. Restart WhatsUp Gold services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to WhatsUp Gold API endpoints to trusted IP addresses only.
Use firewall rules to limit access to TCP ports used by WhatsUp Gold (typically 80/443 and management ports)
API Endpoint Disablement
windowsDisable vulnerable API endpoints if not required for functionality.
Consult vendor documentation for specific API endpoint configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold from untrusted networks
- Monitor for unusual API calls and credential relay attempts in network traffic
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version via web interface (Help > About) or installation directory properties.Check Version:
Check web interface at https://[hostname]:[port]/NMS/Help/About or examine installation directory properties.Verify Fix Applied:
Verify version is 21.1.2 or higher for v21.x, or 22.0.1 or higher for v22.x. Test API endpoints are no longer accessible without authentication.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls from unauthenticated sources
- Credential-related API transactions to external hosts
- Failed authentication attempts following API calls
Network Indicators:
- Outbound connections from WhatsUp Gold to unexpected external IPs
- Unusual API traffic patterns
- Credential data in network traffic
SIEM Query:
source="WhatsUpGold" AND (event_type="api_call" AND user="anonymous") OR (destination_ip NOT IN trusted_networks AND protocol="http" AND uri_contains="credential")