CVE-2024-12108: Critical Vulnerability in WhatsUp Gold Allows Attackers to Gain Access to Servers by Abusing Public API

A newly discovered vulnerability (CVE-2024-12108) in WhatsUp Gold software versions before 2024..2 allows cyber-criminals to exploit vulnerable servers via the public API. WhatsUp Gold is a popular network and application performance monitoring tool that provides businesses with real-time monitoring and reporting. Due to the critical nature of this vulnerability, organizations are urged to update their software to the latest, patched version in order to protect themselves against potential attacks.

A detailed analysis of the vulnerability shows that an attacker can gain access to the server by manipulating the public API. In this post, we will dive deep into the technical details of this vulnerability, provide code snippets, and reference original sources to help you protect your organization against emergent cyber threats.

Vulnerability Details

The main issue with this vulnerability lies in the public API implementation, where insufficient user input validation is performed. Consequently, a malicious user can exploit this flaw to send specially crafted API requests that can compromise the security and integrity of the WhatsUp Gold server.

To gain access to the server, an attacker needs to send a specially crafted API request containing a malicious payload. The payload must be designed to bypass the inadequate input sanitization measures.

Code Snippet

Below is a code snippet demonstrating the exploitation of the vulnerable public API. Please note that the provided code is for educational purposes only and should not be used for malicious intent.

import requests

# Replace 'TARGET' with the address of your vulnerable WhatsUp Gold server
target = "https://TARGET";
api_endpoint = "/public/api/"
malicious_payload = """{
    "<INJECT YOUR PAYLOAD HERE>": "<EXPLOIT_HERE>"
}"""

headers = {
    "Content-Type": "application/json",
    "Accept": "application/json"
}

# Send the malicious API request
response = requests.post(target + api_endpoint, data=malicious_payload, headers=headers)

# If the exploit is successful, the HTTP response will contain the token
if response.status_code == 200:
    print("Exploit successful!")
    print("Token received:", response.text)
else:
    print("Exploit failed. Received HTTP status code:", response.status_code)

This vulnerability was first reported and detailed in the following sources

1. CVE Vulnerability Details: CVE-2024-12108

2. WhatsUp Gold Security Advisory: Ipswitch WhatsUp Gold 2024..2 Release Notes

3. National Vulnerability Database: NVD - CVE-2024-12108

Mitigation and Recommendations

In order to mitigate the risks posed by this critical vulnerability, we highly recommend performing the following actions:

Restrict access to the public API by implementing a strong, role-based security model.

- Regularly monitor your server logs for any suspicious activity that may indicate a breach or attempted attack.

Conclusion

CVE-2024-12108 is a critical vulnerability in the WhatsUp Gold software that attackers can exploit to gain unauthorized access to your network and application monitoring servers. By understanding the technical details of this vulnerability and applying the recommended security measures, you can greatly reduce the likelihood and impact of a successful attack on your organization.

Timeline

Published on: 12/31/2024 11:15:06 UTC
Last modified on: 01/06/2025 16:51:11 UTC