CVE-2024-5017
📋 TL;DR
This path traversal vulnerability in WhatsUp Gold allows unauthenticated attackers to access files outside the intended directory via specially crafted HTTP requests to AppProfileImport. It affects WhatsUp Gold versions before 2023.1.3 and can lead to sensitive information disclosure.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or credentials stored on the server, potentially leading to further compromise.
Likely Case
Information disclosure of application files, configuration data, or other files accessible to the web server process.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to vulnerable instances.
🎯 Exploit Status
Exploitation requires crafting HTTP requests with path traversal sequences. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1.3 and later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold 2023.1.3 or later from Progress website. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart WhatsUp Gold services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to WhatsUp Gold web interface to trusted networks only
Configure firewall rules to block external access to WhatsUp Gold ports (typically 80/443)
Web Application Firewall
allDeploy WAF with path traversal protection rules
Configure WAF to block requests containing ../ sequences
🧯 If You Can't Patch
- Isolate WhatsUp Gold server in restricted network segment with no internet access
- Implement strict network access controls allowing only necessary connections from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in web interface or installation directory. Versions before 2023.1.3 are vulnerable.Check Version:
Check Help > About in WhatsUp Gold web interface or examine installation directory version filesVerify Fix Applied:
Verify version is 2023.1.3 or later and test AppProfileImport endpoint with path traversal attempts returns proper error.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /AppProfileImport with ../ sequences
- Unusual file access patterns in web server logs
Network Indicators:
- HTTP requests containing path traversal sequences to WhatsUp Gold endpoints
SIEM Query:
source="web_logs" AND (uri="/AppProfileImport" AND (request CONTAINS "../" OR request CONTAINS "..\\"))🔗 References
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
- https://www.progress.com/network-monitoring
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
- https://www.progress.com/network-monitoring
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932
