CVE-2024-4885: Progress WhatsUp Gold RCE Vulnerability

CVE-2024-4885 Overview

CVE-2024-4885 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Progress WhatsUp Gold network monitoring software. The vulnerability exists in the WhatsUp.ExportUtilities.Export.GetFileWithoutZip function, which allows attackers to execute arbitrary commands with iisapppool\nmconsole privileges without requiring authentication.

Critical Impact

This vulnerability enables unauthenticated attackers to achieve remote code execution on vulnerable WhatsUp Gold installations, potentially leading to complete system compromise. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• Progress WhatsUp Gold versions released before 2023.1.3
• All WhatsUp Gold installations without the June 2024 security patch applied

Discovery Timeline

• 2024-06-25 - CVE-2024-4885 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2024-4885

Vulnerability Analysis

This vulnerability represents a severe security flaw in Progress WhatsUp Gold's export functionality. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip endpoint is accessible without authentication, creating a direct attack surface for remote adversaries. When exploited, attackers gain the ability to execute arbitrary commands under the context of the IIS application pool identity (iisapppool\nmconsole), which typically has elevated privileges within the application environment.

The unauthenticated nature of this vulnerability significantly increases its risk profile, as attackers do not need valid credentials or prior access to exploit the flaw. Network monitoring systems like WhatsUp Gold are often deployed in privileged positions within enterprise networks, making them high-value targets for threat actors seeking to establish footholds for lateral movement.

Root Cause

The root cause of CVE-2024-4885 stems from insufficient access controls and improper input validation in the GetFileWithoutZip export function. The vulnerability involves Path Traversal (CWE-22) weaknesses that allow attackers to manipulate file paths or parameters in ways that lead to command execution. The lack of authentication requirements on this endpoint compounds the issue by removing any barrier to exploitation.

Attack Vector

The attack vector for CVE-2024-4885 is network-based, requiring no user interaction or prior authentication. An attacker can remotely target exposed WhatsUp Gold installations by sending specially crafted requests to the vulnerable export functionality endpoint.

The exploitation flow typically involves:

1. Identifying an exposed WhatsUp Gold instance on the network
2. Crafting a malicious request targeting the GetFileWithoutZip function
3. Leveraging path traversal or injection techniques to achieve command execution
4. Commands execute with iisapppool\nmconsole privileges, providing significant system access

Organizations with internet-facing WhatsUp Gold deployments are at highest risk, though internal network exposure also presents significant danger from insider threats or attackers who have already breached the perimeter.

Detection Methods for CVE-2024-4885

Indicators of Compromise

• Anomalous HTTP requests to WhatsUp Gold export-related endpoints, particularly those containing path traversal sequences
• Unexpected process execution originating from IIS application pool worker processes (w3wp.exe)
• Suspicious command-line activity associated with the nmconsole application pool identity
• Web server logs showing requests to GetFileWithoutZip or related export endpoints from external or unauthorized sources

Detection Strategies

• Monitor IIS logs for unusual patterns in requests to WhatsUp Gold web application endpoints
• Implement network intrusion detection rules to identify exploitation attempts targeting known vulnerable endpoints
• Deploy endpoint detection and response (EDR) solutions to identify anomalous child process creation from IIS worker processes
• Review authentication logs for attempts to access sensitive functionality without valid credentials

Monitoring Recommendations

• Enable verbose logging on WhatsUp Gold application and associated IIS web servers
• Configure SIEM alerts for command execution events originating from IIS application pools
• Monitor network traffic for connections from WhatsUp Gold servers to unusual external destinations
• Implement file integrity monitoring on critical WhatsUp Gold directories and configuration files

How to Mitigate CVE-2024-4885

Immediate Actions Required

• Upgrade Progress WhatsUp Gold to version 2023.1.3 or later immediately
• If immediate patching is not possible, restrict network access to WhatsUp Gold management interfaces
• Review system logs for evidence of prior exploitation attempts
• Isolate vulnerable WhatsUp Gold instances from untrusted network segments until patching is complete

Patch Information

Progress Software has released a security update addressing CVE-2024-4885 in WhatsUp Gold version 2023.1.3. Organizations should consult the Progress Security Bulletin June 2024 for detailed patching instructions and additional security guidance. Given that this vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog, federal agencies and critical infrastructure organizations may be subject to mandatory remediation timelines.

Workarounds

• Implement network segmentation to restrict access to WhatsUp Gold management interfaces to authorized administrative networks only
• Deploy web application firewall (WAF) rules to block requests containing path traversal patterns targeting WhatsUp Gold endpoints
• Disable or restrict access to the vulnerable export functionality if not operationally required
• Apply principle of least privilege to the IIS application pool identity to limit the impact of potential compromise

# Example: Restrict WhatsUp Gold access via Windows Firewall (adjust IP ranges as needed)
netsh advfirewall firewall add rule name="Block External WhatsUp Gold Access" dir=in action=block protocol=tcp localport=443 remoteip=0.0.0.0-10.0.0.0,10.255.255.255-172.16.0.0,172.31.255.255-192.168.0.0,192.168.255.255-255.255.255.255