Progress WhatsUp Gold: Unauthenticated Remote Code Execution (CVE-2024-4883)

CVE-2024-4883 is a critical vulnerability in Progress WhatsUp Gold that enables unauthenticated remote code execution. The flaw exists within the ICoreServices component's WriteDataFile service, which contains a write-what-where primitive. Exploitation allows an unauthenticated attacker to plant arbitrary files, such as ASPX webshells, into the application's web directory, leading to full system compromise. The vulnerability affects all versions of WhatsUp Gold prior to 23.1.3. A functional proof-of-concept exploit is publicly available.

Attack Chain

1. The attacker establishes a network connection to the ICoreServices service on the target's net.tcp port (typically 9643).
2. The attacker interacts with the WriteDataFile service.
3. The attacker leverages the write-what-where primitive to overwrite or create a file in a chosen destination.
4. The attacker targets the web directory of the WhatsUp Gold installation (e.g., C:\Program Files (x86)\Ipswitch\WhatsUp\html\NmConsole).
5. The attacker plants a malicious ASPX webshell via the primitive.
6. The attacker navigates to the uploaded webshell via a web browser to achieve remote code execution on the underlying server.

Impact

Successful exploitation grants an unauthenticated attacker full system control, including the ability to execute arbitrary code, modify or exfiltrate data, and maintain persistent access to the server. The vulnerability carries a CVSS 3.1 base score of 9.8.

Recommendation

• Patch immediately by upgrading all Progress WhatsUp Gold instances to version 23.1.3 or later.
• Review the official Progress security bulletin for additional guidance: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024.
• Audit the 'html\NmConsole' directory and its subdirectories for any unexpected .aspx files.