CVE-2024-46907
📋 TL;DR
A SQL injection vulnerability in WhatsUp Gold allows authenticated low-privileged users (with at least Report Viewer permissions) to escalate privileges to admin accounts. This affects all WhatsUp Gold versions before 2024.0.1. Attackers can gain full administrative control over the monitoring system.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of WhatsUp Gold instance with admin privileges, allowing attackers to modify configurations, access sensitive network data, deploy malware, or pivot to other systems.
Likely Case
Privilege escalation from low-privileged user to admin, enabling unauthorized access to sensitive monitoring data and system configuration changes.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and input validation are already implemented.
🎯 Exploit Status
Requires authenticated access and SQL injection knowledge. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.0.1 or later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-September-2024
Restart Required: No
Instructions:
1. Download WhatsUp Gold 2024.0.1 or later from Progress website. 2. Backup current configuration and database. 3. Run the installer to upgrade. 4. Verify successful installation and functionality.
🔧 Temporary Workarounds
Restrict User Permissions
allTemporarily remove Report Viewer permissions from non-essential users until patching is complete.
Navigate to Administration > Security > Users in WhatsUp Gold interface and modify permissions
Network Segmentation
allIsolate WhatsUp Gold server from general network access, allowing only necessary administrative connections.
Configure firewall rules to restrict access to WhatsUp Gold server
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application layer
- Deploy web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in Administration > About. If version is below 2024.0.1, system is vulnerable.Check Version:
Check version in WhatsUp Gold web interface at Administration > AboutVerify Fix Applied:
Verify version is 2024.0.1 or higher in Administration > About. Test user permission boundaries remain intact.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts followed by successful admin access
- User permission changes from low-privilege to admin
Network Indicators:
- Unusual database connection patterns from application server
- SQL error messages in HTTP responses
SIEM Query:
source="whatsup_gold" AND (event_type="permission_change" OR sql_error="*injection*")