CVE-2024-46907: Progress WhatsUp Gold SQLi Vulnerability

CVE-2024-46907 Overview

CVE-2024-46907 is a SQL injection vulnerability in Progress WhatsUp Gold versions released before 2024.0.1. The flaw allows an authenticated low-privileged user with at least Report Viewer permissions to inject SQL statements and escalate to the admin account. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Progress addressed the vulnerability in the WhatsUp Gold 2024.0.1 release, documented in the Progress WhatsUp Gold Security Bulletin.

Critical Impact
Authenticated Report Viewers can escalate to administrator, gaining full control over the network monitoring platform and any credentials stored within it.

Affected Products

Progress WhatsUp Gold versions prior to 2024.0.1
Deployments granting the Report Viewer role to non-administrative users
Network monitoring environments running vulnerable WhatsUp Gold builds

Discovery Timeline

2024-12-02 - CVE-2024-46907 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46907

Vulnerability Analysis

The vulnerability resides in WhatsUp Gold functionality accessible to accounts holding the Report Viewer role. User-supplied input reaches a backend SQL query without proper parameterization or sanitization. An authenticated attacker can inject SQL statements that modify data outside the intended report scope. Because the WhatsUp Gold database stores user records and role assignments, injected statements can elevate the attacker's account to administrator. The exploit succeeds over the network with low attack complexity and requires no user interaction, per the CVSS vector.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The affected code path concatenates untrusted input into a query rather than binding values through prepared statements. Progress's fix in 2024.0.1 corrects the query construction pattern so attacker-controlled input can no longer alter query semantics.

Attack Vector

Exploitation requires valid credentials for an account with Report Viewer permissions or higher. The attacker submits crafted parameters through the affected report or query interface. The injected SQL executes with the database privileges of the WhatsUp Gold service account, permitting UPDATE or INSERT statements against user and permission tables. After privilege escalation, the attacker signs in as an administrator and can reconfigure monitoring, exfiltrate stored device credentials, or pivot into the monitored network.

No public proof-of-concept exploit is available. See the Progress WhatsUp Gold Security Bulletin for vendor detail.

Detection Methods for CVE-2024-46907

Indicators of Compromise

Unexpected changes to WhatsUp Gold user roles, particularly Report Viewer accounts promoted to Admin.
Database audit entries showing UPDATE or INSERT statements against the WhatsUp Gold user or permissions tables from the web application service account.
Report generation requests containing SQL metacharacters such as ', --, UNION, or ; in parameter values.
New administrator logins from accounts that historically only performed reporting actions.

Detection Strategies

Enable SQL Server auditing on the WhatsUp Gold database and alert on privilege table modifications outside of maintenance windows.
Inspect IIS or WhatsUp Gold web logs for report endpoints containing injection payload signatures.
Correlate role change events with the originating user session to identify self-elevation.

Monitoring Recommendations

Alert on any account transitioning into an administrative role and require out-of-band verification.
Baseline typical report parameter content and flag statistical outliers containing SQL syntax.
Forward WhatsUp Gold application, IIS, and database logs to a central analytics platform for cross-source correlation.

How to Mitigate CVE-2024-46907

Immediate Actions Required

Upgrade WhatsUp Gold to version 2024.0.1 or later as directed by the Progress WhatsUp Gold Security Bulletin.
Audit all WhatsUp Gold accounts and remove unnecessary Report Viewer and higher privileges.
Rotate credentials stored in WhatsUp Gold for monitored devices if compromise is suspected.
Review recent administrative changes and revert any unauthorized role assignments.

Patch Information

Progress released WhatsUp Gold 2024.0.1 addressing this SQL injection issue. Refer to the Progress WhatsUp Gold 2024.0 Release Notes for upgrade procedures and to the vendor security bulletin for the complete list of fixes bundled with the release.

Workarounds

Restrict WhatsUp Gold web console access to trusted management networks using firewall rules or a VPN gateway.
Enforce multi-factor authentication on all WhatsUp Gold accounts to raise the bar for credential abuse.
Apply least-privilege principles by scoping the SQL account used by WhatsUp Gold so it cannot modify authentication tables where feasible.

bash

# Configuration example: restrict WhatsUp Gold console to a management subnet (Windows Firewall)
New-NetFirewallRule -DisplayName "WhatsUp Gold - Mgmt Only" `
  -Direction Inbound -Protocol TCP -LocalPort 9643 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "WhatsUp Gold - Block Other" `
  -Direction Inbound -Protocol TCP -LocalPort 9643 `
  -Action Block