CVE-2024-12105
📋 TL;DR
This vulnerability allows authenticated users of WhatsUp Gold to craft HTTP requests that can disclose sensitive information. It affects all WhatsUp Gold versions before 2024.0.2. The vulnerability stems from improper path validation (CWE-22).
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could access sensitive configuration files, credentials, or system information, potentially leading to further compromise of the monitoring system or network.
Likely Case
Authenticated users with malicious intent could access information they shouldn't have permission to view, such as configuration details or limited system data.
If Mitigated
With proper authentication controls and network segmentation, the impact is limited to authorized users accessing information they shouldn't see within their privilege level.
🎯 Exploit Status
Exploitation requires authenticated access and crafting specific HTTP requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.0.2
Vendor Advisory: https://www.progress.com/network-monitoring
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold 2024.0.2 or later from Progress website. 2. Backup current installation. 3. Run the installer to upgrade. 4. Restart WhatsUp Gold services.
🔧 Temporary Workarounds
Restrict Network Access
allLimit access to WhatsUp Gold web interface to only trusted networks and users
Review User Permissions
allAudit and minimize authenticated user accounts with access to WhatsUp Gold
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold from sensitive systems
- Enhance monitoring of WhatsUp Gold access logs for unusual HTTP request patterns
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in web interface under Help > About or via installed program detailsCheck Version:
Not applicable - check via web interface or Windows Programs and FeaturesVerify Fix Applied:
Verify version is 2024.0.2 or later and test that path traversal attempts are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests with path traversal patterns
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP requests containing '../' sequences or unusual file paths
SIEM Query:
source="whatsup_gold_logs" AND (http_request CONTAINS "../" OR http_request CONTAINS "..\")