CVE-2024-2449: Progress LoadMaster CSRF Vulnerability

CVE-2024-2449 Overview

CVE-2024-2449 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Progress LoadMaster, a load balancing and application delivery controller from Kemp Technologies. An attacker who knows the IP address or hostname of a target LoadMaster can craft a malicious page that, when visited by an authenticated LoadMaster administrator, issues HTTP requests to the appliance on the administrator's behalf. The CSRF payload executes management transactions using the victim's active session, enabling configuration changes without the administrator's consent.

Critical Impact
Successful exploitation lets an attacker perform privileged HTTP transactions against the LoadMaster management interface using an administrator's authenticated session, affecting confidentiality, integrity, and availability of the appliance.

Affected Products

Progress LoadMaster LTS branch up to and including 7.2.48.10
Progress LoadMaster GA and LTSF branches (per vendor advisory)
Progress LoadMaster MT 7.1.35.10

Discovery Timeline

2024-03-22 - CVE-2024-2449 published to NVD
2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-2449

Vulnerability Analysis

The LoadMaster Web User Interface (WUI) accepts authenticated state-changing HTTP requests without verifying that the request originated from a legitimate, user-driven action within the management UI. Because the appliance relies on browser-supplied session credentials without a cryptographically bound anti-CSRF token, any cross-origin form submission or scripted request inherits the administrator's authority. The flaw is classified under [CWE-352] Cross-Site Request Forgery.

Exploitation requires user interaction: an authenticated administrator must visit attacker-controlled content while a valid LoadMaster session is active in the same browser. The attacker must also know the appliance's IP address or hostname to direct the payload at the correct target. Despite these prerequisites, the impact spans full administrative HTTP transactions, including configuration changes that can alter traffic routing, TLS offload behavior, and access controls.

Root Cause

The LoadMaster management interface does not enforce origin validation or per-request anti-CSRF tokens on authenticated endpoints. Session authority is established solely through cookies or basic-auth credentials replayed by the browser, so the server cannot distinguish a forged cross-site request from a legitimate administrator action.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a page containing auto-submitting forms or XMLHttpRequest/fetch calls targeting the LoadMaster WUI endpoints. When an authenticated administrator loads the page, the browser issues the requests to the known LoadMaster URL with the administrator's session cookies attached, and the appliance executes the requested operation.

No verified public exploit code is available. See the Kemp Technologies Security Advisory CVE-2024-2448 and CVE-2024-2449 for vendor-supplied technical details.

Detection Methods for CVE-2024-2449

Indicators of Compromise

LoadMaster WUI requests whose HTTP Referer or Origin header points to a domain outside the management network or your administrative jump hosts.
Configuration changes in LoadMaster audit logs that do not correlate with a scheduled change ticket or administrator activity.
Administrator browser history showing visits to untrusted external pages immediately preceding LoadMaster configuration events.

Detection Strategies

Forward LoadMaster WUI access and audit logs to a centralized log platform and alert on state-changing requests (POST/PUT/DELETE) whose Origin or Referer header is not the LoadMaster itself.
Correlate administrator session activity with endpoint browsing telemetry to identify configuration changes that follow visits to unfamiliar external sites.
Hunt for repeated identical configuration write operations within short time windows, a signature of automated CSRF payloads.

Monitoring Recommendations

Enable verbose audit logging on every LoadMaster and ingest events into a SIEM for retention and correlation.
Monitor for new or modified Virtual Services, SSL certificates, and access control rules outside of approved change windows.
Track administrator authentication sessions and alert on long-lived sessions that perform sensitive write operations after periods of inactivity.

How to Mitigate CVE-2024-2449

Immediate Actions Required

Upgrade Progress LoadMaster to a fixed release as listed in the Kemp Technologies advisory for CVE-2024-2448 and CVE-2024-2449.
Restrict access to the LoadMaster WUI to dedicated management networks or bastion hosts using firewall rules and ACL entries.
Require administrators to use a dedicated browser or browser profile for LoadMaster management and to log out of the WUI when not in use.

Patch Information

Progress (Kemp Technologies) has published fixed versions in the LoadMaster Security Vulnerabilities advisory. Administrators should review the advisory for the specific patched build that matches their LTS, LTSF, GA, or MT branch and apply the upgrade through the standard LoadMaster update process.

Workarounds

Place the LoadMaster management interface behind a VPN or zero-trust gateway so that only authenticated administrative endpoints can reach it.
Configure browsers used for LoadMaster administration to block third-party cookies and restrict cross-site requests; close the browser after each management session.
Enforce short WUI session timeouts so that an administrator's session is unlikely to be active while browsing other sites.

bash

# Example: restrict LoadMaster WUI access to a management subnet at the network edge
# Replace 198.51.100.0/24 with your administrative network and <loadmaster-ip> with the appliance
iptables -A FORWARD -p tcp -s 198.51.100.0/24 -d <loadmaster-ip> --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d <loadmaster-ip> --dport 443 -j DROP