CVE-2024-4562
📋 TL;DR
This SSRF vulnerability in WhatsUp Gold allows authenticated users to make unauthorized HTTP requests through the HTTP Monitoring functionality. Attackers could potentially access internal systems or services that should not be exposed. All WhatsUp Gold installations before version 2023.1.2 are affected.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could pivot to internal systems, access sensitive internal services, or perform reconnaissance on internal network segments.
Likely Case
Unauthorized access to internal HTTP services, potential data leakage from internal systems, or scanning of internal network resources.
If Mitigated
Limited to authenticated users only, with proper network segmentation preventing access to critical internal systems.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1.2
Vendor Advisory: https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold 2023.1.2 from Progress website. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart WhatsUp Gold services.
🔧 Temporary Workarounds
Restrict HTTP Monitoring Access
allLimit HTTP Monitoring functionality to authorized administrators only through role-based access controls.
Network Segmentation
allIsolate WhatsUp Gold server from sensitive internal networks to limit SSRF impact.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold from sensitive internal systems
- Review and restrict user permissions to minimize authenticated users with HTTP Monitoring access
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in administration interface. If version is below 2023.1.2, system is vulnerable.Check Version:
Check via WhatsUp Gold web interface: Administration > AboutVerify Fix Applied:
Verify version shows 2023.1.2 or higher in administration interface after upgrade.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP monitoring requests from non-admin users
- HTTP requests to internal IP ranges from WhatsUp Gold
Network Indicators:
- Outbound HTTP requests from WhatsUp Gold server to unexpected internal destinations
SIEM Query:
source="WhatsUpGold" AND (event_type="http_monitor" OR action="http_request") AND user!="admin"