CVE-2024-46906: Progress WhatsUp Gold Privilege Escalation

CVE-2024-46906 Overview

CVE-2024-46906 is a SQL Injection vulnerability [CWE-89] affecting Progress WhatsUp Gold versions released before 2024.0.1. The flaw allows an authenticated low-privileged user with at least Report Viewer permissions to inject SQL statements and escalate privileges to the admin account. Progress disclosed the issue in the Progress Security Bulletin September 2024.

WhatsUp Gold is a widely deployed network monitoring solution, making privilege escalation particularly impactful in enterprise environments. The vulnerability carries a CVSS score of 8.8 and an EPSS percentile of 98.5, indicating a high probability of exploitation activity relative to other published CVEs.

Critical Impact
An authenticated Report Viewer can escalate to full administrator privileges over the network, gaining complete control of the WhatsUp Gold monitoring platform and the network telemetry it collects.

Affected Products

Progress WhatsUp Gold versions prior to 2024.0.1
Progress WhatsUp Gold instances with Report Viewer or higher permissions assigned to non-administrative users
On-premises WhatsUp Gold deployments used for network monitoring and management

Discovery Timeline

2024-12-02 - CVE-2024-46906 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46906

Vulnerability Analysis

The vulnerability is a SQL Injection flaw in Progress WhatsUp Gold. An attacker who holds valid credentials with at least Report Viewer permissions can submit crafted input that the application concatenates into a SQL query without proper parameterization or sanitization. The injected SQL executes with the privileges of the database account used by the WhatsUp Gold web tier.

Because report-oriented roles are commonly granted to operational staff and auditors, the attack surface extends beyond privileged administrators. Successful exploitation results in vertical privilege escalation to the admin account, giving the attacker full control over device configuration, credential stores, and monitoring policies.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Application code paths accessible to Report Viewer role members build SQL statements using untrusted input rather than using prepared statements or a strict allow-list. This allows attacker-controlled tokens to alter query structure and read or modify data used for authentication and role assignment.

Attack Vector

The vulnerability is exploitable over the network against the WhatsUp Gold web interface. The attacker must first authenticate with a low-privileged account that holds Report Viewer permissions. After authentication, the attacker sends crafted HTTP requests containing malicious SQL payloads to a vulnerable endpoint. The database processes the injected SQL, enabling the attacker to modify records that govern account roles or extract data needed to impersonate the admin account.

No verified public proof-of-concept code has been released for CVE-2024-46906. See the Progress Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2024-46906

Indicators of Compromise

New or unexpected accounts appearing in the WhatsUp Gold Admin role, or existing low-privileged accounts suddenly gaining administrative rights
HTTP requests from Report Viewer sessions containing SQL metacharacters such as single quotes, UNION SELECT, --, ;, or hex-encoded payloads targeting WhatsUp Gold report endpoints
Anomalous database query patterns or errors in WhatsUp Gold logs referencing malformed SQL statements
Configuration changes in WhatsUp Gold (new monitors, credential exports, integration modifications) initiated by accounts not previously performing such actions

Detection Strategies

Enable and centralize WhatsUp Gold application, IIS, and SQL Server logs, then alert on SQL error responses and abnormal parameter values from authenticated sessions
Baseline normal Report Viewer activity and flag deviations such as access to administrative endpoints or role management functions
Deploy a web application firewall in front of the WhatsUp Gold console with SQL injection signatures tuned for the product's URL patterns

Monitoring Recommendations

Audit WhatsUp Gold role assignments daily and alert on any change to the Admin group membership
Monitor authentication and privilege-change events from the WhatsUp Gold host in your SIEM and correlate with source IP reputation
Track outbound connections and credential retrieval actions from the WhatsUp Gold service account to detect post-exploitation activity

How to Mitigate CVE-2024-46906

Immediate Actions Required

Upgrade Progress WhatsUp Gold to version 2024.0.1 or later as specified in the Progress Security Bulletin September 2024
Review all user accounts and remove Report Viewer or higher permissions from users who do not require them
Rotate credentials for the WhatsUp Gold admin account and any service accounts stored within WhatsUp Gold after patching
Restrict network access to the WhatsUp Gold web console to trusted management networks only

Patch Information

Progress released a fix in WhatsUp Gold 2024.0.1. Administrators should follow the upgrade guidance in the Progress WhatsUp Gold 2024.0 Release Notes and validate the installed version after upgrade. All versions released before 2024.0.1 remain vulnerable and must not be exposed to untrusted authenticated users.

Workarounds

Temporarily suspend or reduce accounts holding Report Viewer permissions until the patch can be applied
Place the WhatsUp Gold console behind a web application firewall configured to block SQL injection payloads
Enforce network segmentation so only jump hosts or administrator workstations can reach the WhatsUp Gold web interface
Enable enhanced logging on the WhatsUp Gold SQL Server backend to capture query patterns for forensic review

bash

# Example firewall restriction limiting WhatsUp Gold console access to a management subnet
# Replace 10.10.20.0/24 with your administrative network and <WUG_HOST_IP> with the server address
iptables -A INPUT -p tcp --dport 9643 -s 10.10.20.0/24 -d <WUG_HOST_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 9643 -d <WUG_HOST_IP> -j DROP