CVE-2024-5009
📋 TL;DR
This vulnerability allows local attackers to modify the administrator password in WhatsUp Gold through improper access control in the SetAdminPassword function. It affects WhatsUp Gold versions before 2023.1.3, potentially enabling unauthorized administrative access.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Local attackers gain administrative privileges, allowing complete system compromise, data theft, and further network exploitation.
Likely Case
Local users or attackers with initial access can escalate privileges to admin, enabling unauthorized configuration changes and data access.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized password changes requiring detection and remediation.
🎯 Exploit Status
Exploitation requires local access but appears straightforward based on the vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1.3 and later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold version 2023.1.3 or later from Progress website. 2. Backup current configuration and data. 3. Run the installer to upgrade. 4. Restart the WhatsUp Gold service and verify functionality.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local access to WhatsUp Gold servers to authorized administrators only.
Monitor Admin Account Changes
allImplement monitoring for administrator password changes and account modifications.
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into WhatsUp Gold servers locally.
- Monitor system logs for unauthorized access attempts and password change activities.
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in the web interface under Help > About or via the installation directory properties.Check Version:
Not applicable - check via web interface or installation properties.Verify Fix Applied:
Verify version is 2023.1.3 or later and test that unauthorized password changes are prevented.📡 Detection & Monitoring
Log Indicators:
- Unusual administrator password change events
- Unauthorized access attempts to WhatsUp Gold administrative functions
Network Indicators:
- Unusual administrative activity from non-standard locations
SIEM Query:
Event logs showing password modification events for WhatsUp Gold admin accounts