CVE-2024-6670
Progress WhatsUp Gold SQL Injection Vulnerability
Description
CVE-2024-6670 is a critical SQL injection vulnerability in Progress WhatsUp Gold, a widely used network monitoring solution. Affecting all versions released before 2024.0.0, this flaw allows unauthenticated attackers to retrieve encrypted user passwords from the application's database. Rated CVSS 9.8 (Critical) with an EPSS probability of 94.47% (100th percentile), this vulnerability has the highest possible exploitation likelihood. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 7, 2024, and it is confirmed to be associated with known ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | whatsup gold | < 24.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
No specific CWE has been assigned to CVE-2024-6670 by NVD. However, the vulnerability is a classic SQL injection flaw where user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. In WhatsUp Gold, certain API endpoints or web interface parameters accept input that is directly concatenated into database queries, allowing an attacker to inject malicious SQL statements. This enables the attacker to bypass authentication logic and directly query the underlying database to extract sensitive data, including encrypted user passwords. SQL injection remains one of the most prevalent and dangerous web application vulnerability classes, and its presence in a network monitoring tool is particularly concerning given the elevated access such tools typically have within enterprise networks.
Impact Analysis
The business impact of CVE-2024-6670 is exceptionally severe due to both the vulnerability's characteristics and the nature of the affected product. Confidentiality is critically compromised, as attackers can extract encrypted user passwords from the database. WhatsUp Gold is a network monitoring platform that stores credentials for SNMP, SSH, WMI, and other protocols used to monitor network devices — a password compromise potentially grants access to routers, switches, servers, and other infrastructure components across the entire network. Integrity is at high risk because SQL injection can be leveraged beyond data extraction to modify database contents, alter monitoring configurations, suppress alerts for ongoing attacks, and manipulate the monitoring data that security teams rely on. Availability faces significant threat as attackers can corrupt or drop database tables, rendering the monitoring platform inoperable during a critical attack window.
The EPSS score of 94.47% at the 100th percentile represents the absolute highest exploitation probability, meaning this vulnerability is more actively exploited than virtually any other tracked CVE. Critically, the CISA KEV entry confirms ransomware association as "Known", making this one of the relatively few CVEs with confirmed use in ransomware campaigns. Network monitoring tools are high-value targets for ransomware operators because they contain credentials and network topology information that facilitates lateral movement across the entire organization. The combination of unauthenticated access, credential extraction, and confirmed ransomware use creates an urgent remediation priority.
Exploit Maturity
CVE-2024-6670 has reached maximum exploit maturity with confirmed active exploitation in ransomware campaigns. CISA's inclusion in the KEV catalog with a deadline of October 7, 2024, and the explicit "Known" ransomware association confirm that this vulnerability is being weaponized by ransomware operators. The EPSS score of 94.47% at the 100th percentile indicates the highest possible exploitation probability. The vulnerability is particularly attractive to attackers because WhatsUp Gold instances are network monitoring platforms that store credentials for connecting to monitored devices, making them high-value pivot points for lateral movement. Progress has published a security bulletin addressing this and related vulnerabilities. The unauthenticated nature of the SQL injection and the value of the extracted data (encrypted passwords for network infrastructure) make this a priority target for both opportunistic and targeted threat actors.
Remediation
-
Upgrade to WhatsUp Gold version 2024.0.0 or later immediately by following the guidance in the Progress WhatsUp Gold Security Bulletin (August 2024). This version addresses the SQL injection vulnerability and should be treated as an emergency update given the confirmed ransomware association.
-
Rotate all credentials stored in WhatsUp Gold after upgrading, including SNMP community strings, SSH keys, WMI credentials, and any other authentication data used for network device monitoring. Assume that if the system was exposed prior to patching, stored credentials may have been compromised.
-
Restrict network access to the WhatsUp Gold web interface by placing it behind a VPN or firewall that limits access to authorized administrators only. The monitoring platform should never be directly accessible from the internet, and internal access should be limited to management networks.
-
Audit network devices for unauthorized access using the credentials that were stored in WhatsUp Gold. Check for unauthorized configuration changes, new user accounts, modified access lists, and any indicators of lateral movement on routers, switches, firewalls, and servers that were monitored by the platform.
-
Implement database-level monitoring and alerting for the WhatsUp Gold database to detect SQL injection attempts and unusual query patterns. Deploy a Web Application Firewall (WAF) in front of the WhatsUp Gold web interface as an additional layer of defense against SQL injection attacks.
Technical Details
CVE-2024-6670 has a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The maximum exploitability vector breakdown: Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means the SQL injection is straightforward to exploit. Privileges Required (PR:N) indicates no authentication is needed — the vulnerability exists in pre-authentication code paths. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) indicates impact within the WhatsUp Gold application context. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) are all High.
The attack mechanism is a SQL injection in WhatsUp Gold's web application layer. The attacker sends crafted HTTP requests to vulnerable API endpoints or web interface parameters that include malicious SQL statements. Because the application fails to properly sanitize or parameterize user input before incorporating it into database queries, the injected SQL is executed by the database engine with the application's database privileges. The primary exploitation goal is extracting encrypted user passwords from the WhatsUp Gold database. While the passwords are stored in encrypted form, the encryption may be reversible if the encryption key is also accessible through the database or application configuration. Even encrypted passwords can be valuable for offline brute-force attacks, especially if weak password policies are in place. The pre-authentication nature of the vulnerability means attackers need only network access to the WhatsUp Gold web interface to begin exploitation.
Frequently Asked Questions
What is CVE-2024-6670?
CVE-2024-6670 is a critical SQL injection vulnerability in Progress WhatsUp Gold network monitoring software that allows unauthenticated attackers to extract encrypted user passwords from the database. It affects all versions before 2024.0.0 and is actively exploited in ransomware campaigns.
Is this vulnerability being used in ransomware attacks?
Yes, CISA has confirmed the ransomware association as "Known," meaning this vulnerability has been directly linked to ransomware campaigns. Network monitoring tools like WhatsUp Gold are high-value targets because they store credentials for network devices, enabling attackers to move laterally across the entire infrastructure.
What data is at risk from this vulnerability?
The primary target is encrypted user passwords stored in the WhatsUp Gold database. However, WhatsUp Gold also stores SNMP community strings, SSH credentials, WMI accounts, and other authentication data used to monitor network devices. Compromise of these credentials could grant attackers access to the organization's entire network infrastructure.
How quickly should I patch this vulnerability?
This vulnerability should be treated as an emergency requiring immediate action. The combination of unauthenticated exploitation, confirmed ransomware use, and the 100th percentile EPSS score means exploitation is virtually certain for any exposed instance. Upgrade to version 2024.0.0 or later and rotate all stored credentials immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.