CVE-2024-7763: Progress WhatsUp Gold Auth Bypass Flaw

CVE-2024-7763 Overview

CVE-2024-7763 is an authentication bypass vulnerability affecting Progress WhatsUp Gold versions released before 2024.0.0. The flaw allows unauthenticated remote attackers to obtain encrypted user credentials from the network monitoring platform. Progress Software disclosed the issue in its August 2024 security bulletin and assigned it to the [CWE-287] Improper Authentication weakness class.

WhatsUp Gold is widely deployed to monitor network infrastructure, servers, and applications. Exposure of stored credentials, even when encrypted, gives attackers a foothold for offline cracking and lateral movement against monitored assets.

Critical Impact
Unauthenticated attackers with network access can retrieve encrypted user credentials from vulnerable WhatsUp Gold instances, enabling downstream credential compromise.

Affected Products

Progress WhatsUp Gold versions released before 2024.0.0
Deployments exposing the WhatsUp Gold web interface to untrusted networks
Environments running unpatched progress:whatsup_gold packages

Discovery Timeline

2024-10-24 - CVE-2024-7763 published to the National Vulnerability Database
2024-10-30 - Last updated in NVD database

Technical Details for CVE-2024-7763

Vulnerability Analysis

The vulnerability is an authentication bypass [CWE-287] in the WhatsUp Gold application stack. An attacker reaches an authenticated function path without supplying valid credentials. The function returns encrypted credential material associated with WhatsUp Gold user accounts.

The issue is reachable over the network and requires no user interaction or prior privileges. Confidentiality impact is high because the response exposes credential data, while integrity and availability of the monitoring service are not directly affected.

Attackers who obtain the encrypted credentials can attempt offline cryptographic attacks or replay them against systems that share the same secret material. Because WhatsUp Gold stores credentials used to access monitored devices, recovered secrets can enable pivoting into routers, switches, hypervisors, and servers.

Root Cause

The root cause is missing or improperly enforced authentication on an endpoint that exposes credential storage. The application trusts the request context without validating an authenticated session, allowing direct access to sensitive credential data. Progress has not published low-level technical details beyond the WhatsUp Gold Security Bulletin August 2024.

Attack Vector

Exploitation occurs over the network against the WhatsUp Gold web interface. An attacker sends crafted HTTP requests to the vulnerable endpoint and receives encrypted credential records in the response. No specific code example is published by the vendor, and no public proof-of-concept exploit is currently available. The EPSS probability is 0.203% as of the most recent scoring date.

Readers should consult the Progress Security Bulletin August 2024 for vendor-supplied technical context.

Detection Methods for CVE-2024-7763

Indicators of Compromise

Unauthenticated HTTP requests to WhatsUp Gold endpoints returning non-empty response bodies containing credential-like fields.
Outbound or internal traffic from the WhatsUp Gold server to monitored devices using credentials shortly after suspicious inbound web requests.
Web server access logs showing repeated probes from a single source against WhatsUp Gold API or handler paths.

Detection Strategies

Inspect WhatsUp Gold IIS or web server access logs for anonymous requests to credential-related handlers and API routes.
Alert on HTTP responses from WhatsUp Gold hosts that contain large encoded blobs returned to sessions without a preceding authenticated login event.
Correlate authentication failures, credential reads, and downstream SSH, SNMP, or WMI activity originating from the WhatsUp Gold server.

Monitoring Recommendations

Forward WhatsUp Gold web, application, and Windows event logs to a centralized SIEM for retention and correlation.
Baseline normal administrative access to the WhatsUp Gold console and alert on requests from unexpected source addresses.
Monitor service accounts stored in WhatsUp Gold for anomalous logon patterns against monitored infrastructure.

How to Mitigate CVE-2024-7763

Immediate Actions Required

Upgrade WhatsUp Gold to version 2024.0.0 or later as specified in the Progress August 2024 security bulletin.
Restrict network access to the WhatsUp Gold management interface using firewall rules and VPN-only access.
Rotate all credentials stored within WhatsUp Gold, including SNMP community strings, SSH keys, and Windows service accounts.
Audit monitored devices for unauthorized logons that used credentials managed by WhatsUp Gold.

Patch Information

Progress addressed CVE-2024-7763 in WhatsUp Gold 2024.0.0. Apply the upgrade following vendor guidance in the WhatsUp Gold Security Bulletin August 2024. Confirm the installed build after upgrade and verify that custom configurations or extensions were not rolled back during the update.

Workarounds

Place the WhatsUp Gold server behind a reverse proxy or VPN that enforces authentication before requests reach the application.
Block external access to WhatsUp Gold TCP ports at the perimeter firewall and limit internal access to administrator subnets.
Disable any unused WhatsUp Gold web services or plug-ins to reduce the attack surface until patching is complete.

bash

# Configuration example: restrict WhatsUp Gold web access on Windows Firewall
netsh advfirewall firewall add rule name="WhatsUp Gold Admin Only" ^
  dir=in action=allow protocol=TCP localport=9643 ^
  remoteip=10.0.0.0/24 profile=any

netsh advfirewall firewall add rule name="Block WhatsUp Gold External" ^
  dir=in action=block protocol=TCP localport=9643 ^
  remoteip=any profile=any