CVE-2024-6671: Progress WhatsUp Gold SQLi Vulnerability

CVE-2024-6671 Overview

CVE-2024-6671 is a SQL Injection vulnerability affecting Progress WhatsUp Gold network monitoring software in versions released before 2024.0.0. When the application is configured with only a single user, an unauthenticated attacker can exploit this vulnerability to retrieve the user's encrypted password through crafted SQL queries. This vulnerability poses significant risk to organizations relying on WhatsUp Gold for network infrastructure monitoring, as successful exploitation could lead to unauthorized access to the monitoring platform.

Critical Impact

An unauthenticated attacker can retrieve encrypted user credentials via SQL Injection, potentially leading to complete compromise of the WhatsUp Gold monitoring infrastructure.

Affected Products

• Progress WhatsUp Gold versions prior to 2024.0.0
• WhatsUp Gold installations configured with a single user account
• Network monitoring deployments using vulnerable WhatsUp Gold versions

Discovery Timeline

• 2024-08-29 - CVE-2024-6671 published to NVD
• 2024-09-04 - Last updated in NVD database

Technical Details for CVE-2024-6671

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in Progress WhatsUp Gold's authentication mechanism. The flaw allows unauthenticated attackers to inject malicious SQL statements that can extract sensitive information from the underlying database. The specific condition requiring a single-user configuration suggests the vulnerability exists in a code path that handles simplified or default authentication scenarios.

SQL Injection vulnerabilities occur when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. In this case, the vulnerability enables direct extraction of encrypted password data, which could subsequently be subjected to offline cracking attempts or used in pass-the-hash style attacks depending on the encryption implementation.

Root Cause

The root cause of CVE-2024-6671 is improper input validation and lack of parameterized queries in the authentication handling code. When WhatsUp Gold is configured with only a single user, the application fails to properly sanitize user input before incorporating it into database queries. This allows attackers to manipulate query logic and extract the encrypted password stored in the database.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can remotely exploit this vulnerability by sending specially crafted requests to the WhatsUp Gold application. The prerequisite condition is that the target installation must be configured with only a single user account, which may be common in smaller deployments or during initial setup phases.

The exploitation flow typically involves:

1. Identifying a WhatsUp Gold instance configured with a single user
2. Crafting SQL injection payloads targeting the authentication mechanism
3. Extracting the encrypted password from database responses
4. Attempting offline decryption or hash-based authentication attacks

For technical details on the vulnerability mechanism, refer to the Progress Security Bulletin August 2024.

Detection Methods for CVE-2024-6671

Indicators of Compromise

• Unusual SQL error messages in WhatsUp Gold application logs
• Anomalous authentication attempts with SQL metacharacters in request parameters
• Database query logs showing injection patterns such as UNION SELECT, OR 1=1, or similar SQL syntax
• Unexpected data extraction patterns from the user credentials table

Detection Strategies

• Monitor web application logs for SQL injection attack signatures in authentication-related endpoints
• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns
• Review database audit logs for unauthorized SELECT queries against user credential tables
• Deploy network-based intrusion detection systems with SQL injection detection rules

Monitoring Recommendations

• Enable detailed logging on WhatsUp Gold authentication endpoints
• Configure alerts for failed authentication attempts with unusual characters
• Monitor for bulk data extraction patterns from the application database
• Implement behavioral analytics to detect anomalous query patterns

How to Mitigate CVE-2024-6671

Immediate Actions Required

• Upgrade Progress WhatsUp Gold to version 2024.0.0 or later immediately
• Review WhatsUp Gold configuration and add additional user accounts if currently using single-user configuration
• Audit authentication logs for signs of prior exploitation attempts
• Consider implementing network segmentation to limit exposure of the WhatsUp Gold interface

Patch Information

Progress has addressed this vulnerability in WhatsUp Gold version 2024.0.0. Organizations should upgrade to this version or later to remediate CVE-2024-6671. The security patch information and upgrade guidance is available in the Progress Security Bulletin August 2024.

Workarounds

• Add additional user accounts to the WhatsUp Gold configuration to avoid the single-user condition
• Restrict network access to the WhatsUp Gold web interface using firewall rules
• Implement a Web Application Firewall (WAF) with SQL injection protection in front of the application
• Consider temporary isolation of vulnerable instances until patching can be completed

# Network restriction example (iptables)
# Limit access to WhatsUp Gold web interface to trusted management networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP