CVE-2024-4885: 
WhatsUp Gold vulnerability analysis and mitigation

An unauthenticated Remote Code Execution (RCE) vulnerability was discovered in Progress WhatsUp Gold versions prior to 2023.1.3. The vulnerability, identified as CVE-2024-4885, exists in the WhatsUp.ExportUtilities.Export.GetFileWithoutZip functionality, which allows execution of commands with iisapppool\nmconsole privileges. The vulnerability was disclosed on June 25, 2024, and received a critical CVSS score of 9.8 (Censys, ZDI).

The vulnerability stems from improper validation of user-supplied paths in file operations within the GetFileWithoutZip method. This implementation flaw allows attackers to perform directory traversal attacks and upload files to arbitrary locations on the server. The vulnerability has been assigned a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating its critical severity and ease of exploitation (ZDI).

The exploitation of this vulnerability could lead to complete system compromise, allowing attackers to execute arbitrary code on affected WhatsUp Gold instances. Successful exploitation could result in data theft, unauthorized access to sensitive information, and full system control under the context of the service account (Censys).

The vulnerability is particularly severe as it requires no authentication to exploit. Multiple proof-of-concept exploits have been published on GitHub, and Censys has observed 1,207 potentially exposed devices online. The attack can be executed by sending crafted requests with directory traversal payloads to upload malicious files (Censys).

Progress Software has released WhatsUp Gold version 2023.1.3 to address this vulnerability. Organizations using affected versions are strongly advised to update to the patched version immediately to mitigate the risk of exploitation (Progress Community).