A critical security flaw impacting Progress Software WhatsUp Gold is currently being actively exploited, emphasizing the urgency for users to promptly apply the latest updates.
The vulnerability in question is CVE-2024-4885 (CVSS score: 9.8), a severe unauthenticated remote code execution flaw affecting versions of the network monitoring application released before 2023.1.3.
“The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\\nmconsole privileges,” the company stated in an advisory issued in late June 2024.
Security researcher Sina Kheirkhah of the Summoning Team identified that the flaw resides in the implementation of the GetFileWithoutZip method, lacking sufficient validation of user-supplied paths before usage.
An attacker could exploit this weakness to execute code within the service account’s context. Kheirkhah has also released a proof-of-concept (PoC) exploit for demonstration.
The Shadowserver Foundation reported exploitation attempts against the vulnerability since August 1, 2024. “Starting Aug 1st, we see /NmAPI/RecurringReport CVE-2024-4885 exploitation callback attempts (so far 6 src IPs),” it mentioned in a post on X.
WhatsUp Gold version 2023.1.3 also fixes two other critical flaws CVE-2024-4883 and CVE-2024-4884 (both with CVSS scores of 9.8), enabling unauthenticated remote code execution through NmApi.exe and Apm.UI.Areas.APM.Controllers.CommunityController, respectively.
Progress Software has also addressed a high-severity privilege escalation vulnerability (CVE-2024-5009, with a CVSS score of 8.4), which allows local attackers to elevate their privileges on affected systems by exploiting the SetAdminPassword method.
Given the history of threat actors exploiting flaws in Progress Software products for malicious activities, administrators must promptly apply the latest security patches and restrict traffic only to trusted IP addresses to mitigate potential risks.