Attack Chain

1. The attacker establishes a network connection to the ICoreServices service on the target's net.tcp port (typically 9643).
2. The attacker interacts with the WriteDataFile service.
3. The attacker leverages the write-what-where primitive to overwrite or create a file in a chosen destination.
4. The attacker targets the web directory of the WhatsUp Gold installation (e.g., C:\Program Files (x86)\Ipswitch\WhatsUp\html\NmConsole).
5. The attacker plants a malicious ASPX webshell via the primitive.
6. The attacker navigates to the uploaded webshell via a web browser to achieve remote code execution on the underlying server.

Impact

Successful exploitation grants an unauthenticated attacker full system control, including the ability to execute arbitrary code, modify or exfiltrate data, and maintain persistent access to the server. The vulnerability carries a CVSS 3.1 base score of 9.8.

Recommendation

• Patch immediately by upgrading all Progress WhatsUp Gold instances to version 23.1.3 or later.
• Review the official Progress security bulletin for additional guidance: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024.
• Audit the 'html\NmConsole' directory and its subdirectories for any unexpected .aspx files.