CVE-2024-5008 Overview
CVE-2024-5008 is an arbitrary file upload vulnerability in Progress WhatsUp Gold versions released before 2023.1.3. An authenticated user with specific permissions can abuse the Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController endpoint to upload arbitrary files. Successful exploitation results in remote code execution (RCE) on the underlying host. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. WhatsUp Gold is a widely deployed network monitoring product, and RCE on the server exposes credentials, monitoring data, and lateral movement paths across managed infrastructure.
Critical Impact
Authenticated attackers can upload arbitrary files through the APM AppProfileImport controller and execute code on the WhatsUp Gold server, compromising an internal network monitoring platform.
Affected Products
- Progress WhatsUp Gold versions released before 2023.1.3
- Application Performance Monitoring (APM) module using AppProfileImportController
- WhatsUp Gold deployments accepting authenticated API requests on the network
Discovery Timeline
- 2024-06-25 - CVE-2024-5008 published to the National Vulnerability Database (NVD)
- June 2024 - Progress publishes WhatsUp Gold Security Bulletin June 2024
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-5008
Vulnerability Analysis
The vulnerability resides in the AppProfileImportController under the Apm.UI.Areas.APM.Controllers.Api.Applications namespace. This controller handles import operations for Application Performance Monitoring profiles. The controller accepts uploaded content without adequately validating file type, extension, or destination path. An authenticated user with the required permissions can direct the import routine to write attacker-controlled content to a location that the web application executes. The Exploit Prediction Scoring System (EPSS) places this issue in a high-probability band, reflecting active interest from opportunistic scanners against exposed WhatsUp Gold instances.
Root Cause
The root cause is missing or insufficient server-side validation on file upload input handled by the APM import controller. The application trusts filename, extension, and content type provided by the caller. It does not enforce a strict allowlist of file types or a sandboxed write location outside the web root. This aligns directly with CWE-434, unrestricted upload of file with dangerous type.
Attack Vector
An attacker first authenticates to WhatsUp Gold with an account that holds APM-related permissions. The attacker then issues an HTTP request to the AppProfileImport API endpoint carrying a malicious payload, typically a server-executable file such as an ASP.NET handler. Once written to a location served by the application, the file is invoked by a follow-up HTTP request, executing code in the context of the WhatsUp Gold service account. Because WhatsUp Gold commonly runs with elevated privileges to poll infrastructure, the resulting RCE can be leveraged for credential theft and lateral movement.
No verified public proof-of-concept exploit code is available. See the Progress Security Bulletin June 2024 for vendor technical details.
Detection Methods for CVE-2024-5008
Indicators of Compromise
- Unexpected HTTP POST requests to paths containing AppProfileImport or the Apm/UI/Areas/APM/Controllers/Api/Applications/ route.
- New or modified files with executable extensions (.aspx, .ashx, .asmx, .dll) written under the WhatsUp Gold web application directories.
- Child processes such as cmd.exe, powershell.exe, or w3wp.exe-spawned utilities originating from the WhatsUp Gold IIS worker process.
- Outbound network connections from the WhatsUp Gold server to unfamiliar external IP addresses shortly after an import API call.
Detection Strategies
- Inspect IIS and application logs for calls to the AppProfileImportController correlated with newly created files in web-served directories.
- Enable file integrity monitoring on WhatsUp Gold installation folders to flag creation of script or binary files outside patch windows.
- Alert on process ancestry where the WhatsUp Gold or IIS process spawns shells, script hosts, or reconnaissance binaries.
Monitoring Recommendations
- Forward WhatsUp Gold Windows Event Logs and IIS logs to a centralized SIEM for correlation with endpoint telemetry.
- Baseline normal APM import activity and alert on off-hours or high-volume import requests.
- Monitor authentication logs for WhatsUp Gold accounts with APM permissions and flag unusual source IPs or session behavior.
How to Mitigate CVE-2024-5008
Immediate Actions Required
- Upgrade Progress WhatsUp Gold to version 2023.1.3 or later, as directed in the vendor bulletin.
- Restrict network access to the WhatsUp Gold management interface using firewalls or VPN-only access.
- Audit WhatsUp Gold user accounts and remove APM permissions from any account that does not require them.
- Rotate credentials and API tokens configured in WhatsUp Gold if compromise is suspected.
Patch Information
Progress addressed CVE-2024-5008 in WhatsUp Gold 2023.1.3. Refer to the Progress WhatsUp Gold Security Bulletin June 2024 for the full list of fixes released alongside this CVE and for upgrade guidance. Apply the vendor patch rather than relying solely on workarounds.
Workarounds
- If patching is not immediately possible, block external and untrusted internal access to the WhatsUp Gold web interface at the network perimeter.
- Enforce least privilege by removing APM administrative rights from non-essential accounts until the upgrade is applied.
- Deploy a web application firewall rule to reject POST requests targeting the AppProfileImport endpoint from unexpected sources.
- Enable multi-factor authentication on all WhatsUp Gold accounts to raise the cost of credential-based exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
