CVE-2024-5019
📋 TL;DR
This vulnerability allows unauthenticated attackers to read arbitrary files on WhatsUp Gold servers with IIS application pool privileges. It affects WhatsUp Gold versions before 2023.1.3, potentially exposing sensitive configuration files and system information.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, credentials, or system files, leading to further system compromise or data exfiltration.
Likely Case
Unauthenticated file reads of web application files, configuration files, or other accessible system files with the IIS app pool identity.
If Mitigated
Limited file access restricted to what the IIS application pool identity can read, with no write or execution capabilities.
🎯 Exploit Status
Unauthenticated exploitation via web request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1.3 or later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold 2023.1.3 or later from Progress website. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart WhatsUp Gold services.
🔧 Temporary Workarounds
Restrict network access
allLimit access to WhatsUp Gold web interface to trusted networks only
Web Application Firewall rules
allImplement WAF rules to block requests to the vulnerable SessionController.CachedCSS endpoint
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold servers
- Deploy web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in web interface or installation directory. Versions before 2023.1.3 are vulnerable.Check Version:
Check web interface About page or examine installation directory version filesVerify Fix Applied:
Verify version is 2023.1.3 or later and test that arbitrary file read attempts via the vulnerable endpoint are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in IIS logs
- Requests to /Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS with file path parameters
Network Indicators:
- HTTP requests attempting directory traversal or file read patterns
SIEM Query:
source="IIS" AND (uri="*SessionController.CachedCSS*" OR uri="*../*" OR uri="*..\\*")