CVE-2024-46908
📋 TL;DR
A SQL injection vulnerability in WhatsUp Gold allows authenticated users with Report Viewer permissions to escalate privileges to admin accounts. This affects WhatsUp Gold versions before 2024.0.1. Attackers can exploit this to gain full administrative control over the monitoring system.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of WhatsUp Gold instance with administrative access, allowing attackers to modify configurations, access sensitive network data, and potentially pivot to other systems.
Likely Case
Privilege escalation from low-privileged user to admin, enabling unauthorized access to monitoring data and system controls.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and input validation are implemented.
🎯 Exploit Status
Requires authenticated access with Report Viewer permissions; SQL injection techniques are well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.0.1 or later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-September-2024
Restart Required: No
Instructions:
1. Download WhatsUp Gold 2024.0.1 or later from Progress website. 2. Backup current installation. 3. Run the installer to upgrade. 4. Verify successful upgrade in administration console.
🔧 Temporary Workarounds
Restrict Report Viewer Permissions
allTemporarily remove Report Viewer permissions from non-essential users until patching.
Use WhatsUp Gold administration console to modify user roles
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold from critical systems
- Apply web application firewall (WAF) rules to block SQL injection patterns
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in administration console under Help > About.Check Version:
Not applicable - check via administration console GUIVerify Fix Applied:
Confirm version is 2024.0.1 or later in administration console.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts followed by successful admin login from same user
Network Indicators:
- Unusual database queries from WhatsUp Gold application server
SIEM Query:
source="whatsup_gold" AND (event_type="sql_error" OR user_role_change="admin")