CVE-2024-8755: Progress LoadMaster RCE Vulnerability

CVE-2024-8755 Overview

CVE-2024-8755 is an Improper Input Validation vulnerability in Progress LoadMaster that enables OS Command Injection. This vulnerability affects authenticated users and allows attackers to execute arbitrary operating system commands on affected LoadMaster appliances, Multi-Tenant Hypervisor, and ECS systems.

Critical Impact

This OS Command Injection vulnerability allows authenticated attackers to execute arbitrary system commands with network-level access, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network infrastructure.

Affected Products

• Progress LoadMaster versions from 7.2.55.0 to 7.2.60.1 (inclusive)
• Progress LoadMaster versions from 7.2.49.0 to 7.2.54.12 (inclusive)
• Progress LoadMaster version 7.2.48.12 and all prior versions
• Multi-Tenant Hypervisor version 7.1.35.12 and all prior versions
• ECS all versions prior to and including 7.2.60.1

Discovery Timeline

• 2024-10-11 - CVE-2024-8755 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2024-8755

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) that enables OS command injection (CWE-78) within Progress LoadMaster appliances. When an authenticated user submits specially crafted input to vulnerable endpoints, the application fails to properly sanitize user-controlled data before passing it to system shell commands. This allows attackers to inject and execute arbitrary operating system commands within the context of the LoadMaster application.

The attack is network-accessible and requires no user interaction once authentication credentials are obtained. Load balancers like LoadMaster typically sit at critical points in network infrastructure, making this vulnerability particularly dangerous as successful exploitation could provide attackers with a foothold to pivot to backend systems and intercept or manipulate traffic.

Root Cause

The root cause of CVE-2024-8755 is insufficient input validation in the LoadMaster application. User-supplied input is not properly sanitized before being incorporated into operating system commands. This allows shell metacharacters and command separators to be interpreted by the underlying operating system, enabling command chaining and arbitrary command execution.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker with valid credentials can craft malicious input containing OS command injection payloads (such as command separators like ;, |, &&, or backtick command substitution). When this input is processed by vulnerable functions within LoadMaster, the injected commands are executed by the underlying operating system with the privileges of the LoadMaster application process.

Given that load balancers often run with elevated privileges to manage network traffic and configurations, successful exploitation could result in complete control over the appliance, allowing attackers to modify load balancing rules, intercept sensitive traffic, or use the compromised device as a pivot point for further attacks.

Detection Methods for CVE-2024-8755

Indicators of Compromise

• Unusual process spawning from LoadMaster application processes, particularly shell processes (/bin/sh, /bin/bash)
• Unexpected outbound network connections from LoadMaster appliances to external IP addresses
• Anomalous authentication patterns or brute-force attempts against LoadMaster management interfaces
• Presence of unauthorized scripts, binaries, or configuration modifications on LoadMaster systems

Detection Strategies

• Monitor LoadMaster system logs for command injection patterns, including shell metacharacters in user input fields
• Implement network-based intrusion detection rules to identify OS command injection attempts in HTTP/HTTPS traffic to LoadMaster management interfaces
• Deploy endpoint detection and response (EDR) solutions on LoadMaster appliances to detect anomalous process execution chains

Monitoring Recommendations

• Enable comprehensive audit logging on all LoadMaster management interfaces and review logs regularly for suspicious activity
• Implement alerting for authentication failures and unusual administrative actions on LoadMaster devices
• Monitor network traffic patterns from LoadMaster appliances for signs of data exfiltration or command-and-control communication

How to Mitigate CVE-2024-8755

Immediate Actions Required

• Update Progress LoadMaster, Multi-Tenant Hypervisor, and ECS to the latest patched versions immediately
• Review and audit all user accounts with access to LoadMaster management interfaces, removing unnecessary accounts and enforcing strong authentication
• Restrict network access to LoadMaster management interfaces to trusted administrative networks only
• Review system logs for any indicators of prior exploitation attempts

Patch Information

Progress has released security updates to address this vulnerability. Organizations should update to versions newer than the affected ranges. Refer to the Kemp Technologies Security Advisory for specific patch versions and download links.

Workarounds

• Implement network segmentation to isolate LoadMaster management interfaces from untrusted networks
• Deploy a web application firewall (WAF) in front of LoadMaster management interfaces to filter command injection attempts
• Enforce multi-factor authentication for all administrative access to LoadMaster systems
• Implement strict access control lists (ACLs) limiting management interface access to specific administrator IP addresses

# Example: Restrict management interface access via firewall rules
# Allow only trusted admin subnet to access LoadMaster management port
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP