CVE-2024-8785: Progress WhatsUp Gold RCE Vulnerability

CVE-2024-8785 Overview

CVE-2024-8785 is a registry manipulation vulnerability in Progress WhatsUp Gold network monitoring software. In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage the NmAPI.exe component to create or change an existing registry value in the registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\. This vulnerability allows unauthorized modification of Windows registry entries without requiring any authentication, potentially enabling attackers to alter application behavior or configuration settings.

Critical Impact

Remote unauthenticated attackers can manipulate Windows registry values on systems running vulnerable WhatsUp Gold installations, potentially compromising system integrity and application configuration.

Affected Products

• Progress WhatsUp Gold versions prior to 2024.0.1
• Systems with exposed NmAPI.exe component
• Windows environments with WhatsUp Gold network monitoring deployed

Discovery Timeline

• 2024-12-02 - CVE CVE-2024-8785 published to NVD
• 2024-12-09 - Last updated in NVD database

Technical Details for CVE-2024-8785

Vulnerability Analysis

This vulnerability stems from improper authentication and authorization controls in the NmAPI.exe component of WhatsUp Gold. The affected API endpoint fails to validate the identity of requesting clients before processing registry modification requests. This allows any network-accessible attacker to interact with the API and execute registry operations targeting the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ registry path.

The vulnerability is classified under CWE-648 (Incorrect Use of Privileged APIs), indicating that the application improperly exposes privileged functionality without adequate access controls. The attack can be executed remotely over the network without any prerequisites such as valid credentials or user interaction, making it particularly dangerous in environments where WhatsUp Gold is network-accessible.

Root Cause

The root cause lies in the NmAPI.exe component's failure to implement proper authentication mechanisms for registry manipulation operations. The API exposes privileged Windows registry modification capabilities to unauthenticated remote users, allowing arbitrary modifications within the Ipswitch registry namespace. This represents a classic case of missing authentication for critical functionality combined with improper use of privileged APIs.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring any authentication or user interaction. An attacker with network access to a vulnerable WhatsUp Gold installation can send specially crafted requests to the NmAPI.exe component to create new registry keys or modify existing values within the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ path.

The exploitation process involves an attacker identifying a vulnerable WhatsUp Gold instance, crafting API requests targeting the NmAPI.exe component, and submitting registry modification commands. Successful exploitation could allow attackers to alter application configurations, potentially leading to further compromise of the monitoring infrastructure or the systems it monitors. Technical details regarding the specific API calls and request formats can be found in the Progress WhatsUp Gold Security Bulletin.

Detection Methods for CVE-2024-8785

Indicators of Compromise

• Unexpected modifications to registry values under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\
• Unusual network connections or API calls to the NmAPI.exe process from external or unauthorized sources
• Anomalous registry creation or modification events correlated with WhatsUp Gold service activity
• Evidence of unauthenticated API requests in WhatsUp Gold or web server logs

Detection Strategies

• Monitor Windows Security Event Logs for registry modification events (Event ID 4657) targeting the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ path
• Implement network traffic analysis to detect unauthorized API requests to WhatsUp Gold services
• Deploy endpoint detection rules to alert on unexpected NmAPI.exe process behavior or registry operations
• Use SentinelOne's behavioral AI to detect anomalous registry manipulation patterns associated with this vulnerability

Monitoring Recommendations

• Enable Windows audit policies for registry access and modification events in the Ipswitch registry namespace
• Configure SIEM alerts for registry changes to WhatsUp Gold configuration paths from non-administrative processes
• Implement network segmentation monitoring to detect external access attempts to WhatsUp Gold API endpoints
• Review WhatsUp Gold application logs regularly for signs of unauthorized API activity

How to Mitigate CVE-2024-8785

Immediate Actions Required

• Upgrade Progress WhatsUp Gold to version 2024.0.1 or later immediately
• Restrict network access to WhatsUp Gold services using firewalls or network ACLs to trusted management networks only
• Monitor registry activity under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ for unauthorized modifications
• Review existing registry values in the affected path for any suspicious or unauthorized changes

Patch Information

Progress has released version 2024.0.1 of WhatsUp Gold which addresses this vulnerability. Organizations should upgrade to this version or later to remediate CVE-2024-8785. Detailed patch information and upgrade instructions are available in the Progress WhatsUp Gold Security Bulletin and the WhatsUp Gold 2024.0 Release Notes.

Workarounds

• Implement strict network segmentation to prevent unauthorized access to WhatsUp Gold services from untrusted networks
• Configure Windows Firewall rules to block external access to ports used by NmAPI.exe
• Deploy registry monitoring and protection tools to detect and prevent unauthorized modifications to the Ipswitch registry path
• Consider temporarily disabling network exposure of the WhatsUp Gold API if immediate patching is not possible

# Example Windows Firewall rule to restrict NmAPI access (adjust port as needed)
netsh advfirewall firewall add rule name="Block WhatsUp Gold NmAPI External Access" dir=in action=block protocol=tcp localport=9644 remoteip=any