CVE-2024-6670

What it actually does

CVE-2024-6670 is an unauthenticated SQL injection vulnerability in Progress WhatsUp Gold versions before 2024.0.0. A remote attacker can send crafted input to a vulnerable web-accessible component and cause backend SQL queries to execute attacker-controlled logic. The documented impact is disclosure of users' encrypted password data, which can support offline password cracking, credential replay if weakly protected, account takeover, and follow-on compromise of the WhatsUp Gold application and monitored infrastructure. The CVSS 9.8 rating, EPSS of 0.94661, active exploitation, CISA KEV listing, and ransomware association indicate high real-world exploitability and operational urgency.

Why it matters to the business

Successful exploitation can expose credentials from a network monitoring platform that often has broad visibility into servers, network devices, service accounts, and operational alerts. If attackers recover or crack user passwords, they may gain administrative access to WhatsUp Gold, disable monitoring, steal network inventory, pivot to monitored assets, or support ransomware operations. Because this vulnerability is in CISA KEV, has been used in ransomware activity, and had a CISA remediation due date of 2024-10-07, unpatched internet-facing instances represent a material incident risk rather than a theoretical exposure.

How an attack unfolds

An attacker first identifies an exposed WhatsUp Gold web interface running a version released before 2024.0.0. They then send crafted unauthenticated HTTP requests containing SQL injection payloads to the vulnerable application component. If the request reaches the vulnerable code path, the application passes attacker-controlled input into a backend SQL query, allowing the attacker to alter query behavior and extract sensitive records, including encrypted user password values. The attacker can then attempt offline cracking, reuse recovered credentials against the application or related systems, create or abuse application sessions if credentials are recovered, and use the monitoring system's privileged position for reconnaissance, lateral movement, persistence, data theft, or ransomware staging. Public exploitation and KEV/ransomware status mean defenders should assume automated scanning and opportunistic exploitation are likely against exposed systems.

How to fix it

Upgrade Progress WhatsUp Gold to version 2024.0.0 or later, which is the vendor-stated fixed release for versions before 2024.0.0. Treat patching as urgent for any internet-facing instance because the vulnerability is actively exploited, listed in CISA KEV, and associated with ransomware activity. If immediate upgrade is not possible, restrict access to the WhatsUp Gold web interface to trusted administrative networks or VPN, block direct internet exposure, apply WAF rules for SQL injection payloads, and monitor for suspicious unauthenticated requests. After patching, rotate WhatsUp Gold user passwords and any credentials that may have been stored, reused, or accessible through the platform; review accounts, roles, API access, and integrations for unauthorized changes.

How to confirm the fix worked

Confirm the installed WhatsUp Gold version is 2024.0.0 or later through the application UI, server file version metadata, or vendor-supported inventory tooling. Verify that no vulnerable pre-2024.0.0 instances remain exposed externally or internally. Confirm access controls limit the management interface to trusted networks. Review web server, application, and database logs for unauthenticated requests with SQL injection patterns before and after remediation. If a vulnerability scanner or vendor-provided check is available, run it against all WhatsUp Gold instances and confirm the finding is closed. Validate that user password resets and credential rotation were completed where exposure is suspected.

Typical attack path

1. Scan the internet or internal address space for exposed Progress WhatsUp Gold web interfaces.
2. Fingerprint the application version or infer vulnerability based on response behavior.
3. Send unauthenticated HTTP requests containing SQL injection payloads to the vulnerable endpoint or parameter.
4. Use database error responses, timing behavior, or extracted output to confirm SQL injection.
5. Retrieve encrypted WhatsUp Gold user password data or related account records from the backend database.
6. Attempt offline cracking or credential reuse against WhatsUp Gold and adjacent systems.
7. Use valid credentials or application access to enumerate monitored infrastructure, disable alerts, pivot, or stage ransomware activity.

How to detect it

Hunt across IIS or reverse-proxy access logs, WhatsUp Gold application logs, Windows Event Logs, database audit logs, EDR telemetry, and network security controls. Look for unauthenticated HTTP requests to the WhatsUp Gold web interface containing SQL metacharacters or payloads such as UNION SELECT, boolean conditions, comments, stacked queries, database metadata queries, or time-delay probes. Correlate suspicious requests with HTTP 500 errors, unusually large responses, repeated requests to the same endpoint with changing parameters, database errors, or outbound activity after the request. Review database logs for unexpected SELECT queries against user/account/password-related tables, access to INFORMATION_SCHEMA or system catalog views, and anomalous queries issued by the WhatsUp Gold application account. On the host, look for new or modified application users, unexpected administrator logins, configuration changes, disabled alerts, unusual child processes spawned by web or application services, credential dumping tools, archive creation, or ransomware precursor activity. Because this vulnerability is known to be exploited in the wild and associated with ransomware, absence of a successful exploit string is not sufficient; investigate any vulnerable, exposed instance as potentially compromised until logs and credentials have been reviewed.

• UNION SELECT
• UNION+SELECT
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• WAITFOR DELAY
• WAITFOR+DELAY
• SLEEP(
• BENCHMARK(
• INFORMATION_SCHEMA
• sys.objects
• sys.tables
• @@version
• ' OR '1'='1
• %27%20OR%20%271%27%3D%271
• --
• /*
• xp_cmdshell
• C:\Program Files (x86)\Ipswitch\WhatsUp\Logs\
• C:\Program Files\Ipswitch\WhatsUp\Logs\
• NmService.exe
• WhatsUpGold.exe

What your security team should do

• Immediately identify all Progress WhatsUp Gold deployments, especially internet-facing systems, and prioritize any version before 2024.0.0 for emergency remediation.
• Upgrade to WhatsUp Gold 2024.0.0 or later; if patching cannot be completed immediately, remove internet exposure and restrict access to trusted administrative networks.
• Because this vulnerability is in CISA KEV and associated with ransomware, initiate threat hunting for exploitation attempts and potential credential theft on all affected instances.
• Rotate WhatsUp Gold local/application user passwords, administrator credentials, and any reused credentials after patching or if exploitation is suspected.
• Review WhatsUp Gold accounts, roles, integrations, API access, alerting configuration, and monitored-device credentials for unauthorized changes or suspicious use.
• Inspect IIS/web/application/database logs for SQL injection payloads, unusual unauthenticated access, database errors, large responses, and repeated probing from external IP addresses.
• Ensure backups, monitoring, and incident response playbooks account for the risk that attackers may use the monitoring platform to suppress alerts or support ransomware staging.