CVE-2024-12106: Progress WhatsUp Gold Auth Bypass Flaw

CVE-2024-12106 Overview

CVE-2024-12106 affects Progress WhatsUp Gold versions released before 2024.0.2. The flaw allows an unauthenticated remote attacker to configure Lightweight Directory Access Protocol (LDAP) settings on the network monitoring server. The weakness is classified under [CWE-306] Missing Authentication for Critical Function. By altering LDAP configuration without credentials, an attacker can redirect authentication flows to an attacker-controlled directory server. This compromises the integrity of authentication and downstream access decisions across the monitored environment.

Critical Impact
An unauthenticated network attacker can rewrite LDAP settings in WhatsUp Gold, redirecting authentication to a hostile directory and compromising integrity of access control.

Affected Products

Progress WhatsUp Gold versions prior to 2024.0.2
Progress WhatsUp Gold network monitoring deployments exposed to untrusted networks
Any WhatsUp Gold instance configured to use LDAP-based authentication

Discovery Timeline

2024-12-31 - CVE-2024-12106 published to the National Vulnerability Database
2025-01-06 - Last updated in NVD database

Technical Details for CVE-2024-12106

Vulnerability Analysis

WhatsUp Gold exposes administrative endpoints used to configure LDAP authentication for the product. In versions prior to 2024.0.2, these endpoints do not enforce authentication. A remote attacker reaching the management interface over the network can submit LDAP configuration changes directly. This grants control over which directory server WhatsUp Gold trusts for authenticating subsequent user logins. The weakness aligns with [CWE-306] Missing Authentication for Critical Function. The Exploit Prediction Scoring System (EPSS) places this CVE in the 96.975 percentile, indicating substantially elevated likelihood of exploitation activity relative to the broader CVE population.

Root Cause

The root cause is the absence of an authentication check on the LDAP configuration handler. Functions that mutate sensitive server state should require an authenticated administrative session. In affected releases the handler accepts configuration writes from any network caller, treating the request as if it originated from a privileged user.

Attack Vector

Exploitation requires only network reachability to the WhatsUp Gold web interface. The attacker sends a crafted request to the LDAP configuration endpoint and supplies the hostname, port, bind credentials, and search base of a directory server they control. Once WhatsUp Gold is repointed, future LDAP authentication attempts can be answered by the attacker. This enables takeover of administrative access, escalation through the monitoring platform, and pivoting into the broader infrastructure WhatsUp Gold observes.

No public proof-of-concept code has been released for this issue at the time of writing. Refer to the Progress Network Monitoring Overview for product context.

Detection Methods for CVE-2024-12106

Indicators of Compromise

Unexpected modifications to LDAP server hostname, port, or bind distinguished name in WhatsUp Gold configuration
Outbound LDAP or LDAPS connections from the WhatsUp Gold host to unfamiliar IP addresses or domains
Successful administrative logins from accounts that were not previously provisioned in the directory
HTTP requests to WhatsUp Gold LDAP configuration endpoints originating from unauthenticated sessions

Detection Strategies

Inspect WhatsUp Gold web server access logs for requests to LDAP configuration paths that lack a valid authenticated session identifier
Compare current LDAP configuration values against a known-good baseline and alert on drift
Monitor egress traffic from the WhatsUp Gold server for LDAP destinations outside the approved directory infrastructure

Monitoring Recommendations

Forward WhatsUp Gold application and IIS logs to a centralized log platform for retention and correlation
Alert on any change event affecting authentication provider configuration on monitoring servers
Track administrative account creation and group membership changes in the directory that WhatsUp Gold trusts

How to Mitigate CVE-2024-12106

Immediate Actions Required

Upgrade WhatsUp Gold to version 2024.0.2 or later, which addresses the missing authentication check
Restrict network access to the WhatsUp Gold management interface to trusted administrative subnets only
Audit current LDAP configuration values and revert any unauthorized changes to a known-good baseline
Rotate bind account credentials used by WhatsUp Gold to authenticate against the directory

Patch Information

Progress addresses CVE-2024-12106 in WhatsUp Gold 2024.0.2. Administrators should obtain the fixed release through their standard Progress support channel and validate the installed version after upgrade. See the Progress Network Monitoring Overview for product information.

Workarounds

Place WhatsUp Gold behind a reverse proxy or firewall that enforces source IP allow-listing for management URLs
Disable external exposure of the WhatsUp Gold web console until the patched version is deployed
Require VPN connectivity for administrative access to the monitoring server

bash

# Example: restrict access to the WhatsUp Gold web interface to an admin subnet on Windows Firewall
New-NetFirewallRule -DisplayName "WhatsUpGold-Admin-Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443,9643 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "WhatsUpGold-Block-Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443,9643 `
  -Action Block