CVE-2024-6672
📋 TL;DR
This SQL injection vulnerability in WhatsUp Gold allows authenticated low-privileged users to modify privileged user passwords, leading to privilege escalation. It affects all WhatsUp Gold versions before 2024.0.0. Attackers can gain administrative access to the network monitoring system.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of WhatsUp Gold installation leading to administrative access, potential lateral movement to monitored systems, and disruption of network monitoring capabilities.
Likely Case
Attacker gains administrative privileges within WhatsUp Gold, accesses sensitive network monitoring data, and potentially modifies monitoring configurations.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring controls are in place to detect unusual authentication patterns.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized, and authenticated access requirement makes this easier for internal attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.0.0 or later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
Restart Required: Yes
Instructions:
1. Download WhatsUp Gold 2024.0.0 or later from Progress website. 2. Backup current installation and configuration. 3. Run the installer to upgrade. 4. Restart the WhatsUp Gold service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to WhatsUp Gold administration interface to only trusted management networks.
Access Control Review
allReview and minimize low-privileged user accounts in WhatsUp Gold.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the WhatsUp Gold web interface
- Enable detailed logging and monitoring for authentication and user management activities
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in administration interface or via installed program details.Check Version:
Check via WhatsUp Gold web interface: Admin > About, or check installed programs in Windows.Verify Fix Applied:
Verify version is 2024.0.0 or later in administration interface.📡 Detection & Monitoring
Log Indicators:
- Unusual password reset activities
- Multiple failed login attempts followed by successful privileged access
- SQL error messages in application logs
Network Indicators:
- Unusual authentication patterns to WhatsUp Gold web interface
- Requests containing SQL injection patterns
SIEM Query:
source="whatsup_gold" AND (event_type="password_change" OR event_type="user_modify") AND user_privilege="low" AND target_user_privilege="high"