WhatsUp Gold WriteDataFile ディレクトリトラバーサルによるリモートコード実行の脆弱性

The impact of CVE-2024-46909 is severe. Successful exploitation allows an attacker to execute code with the privileges of the WhatsUp Gold service account. This could enable them to install malware, steal sensitive data, modify system configurations, or even pivot to other systems on the network. Given the monitoring nature of WhatsUp Gold, attackers could potentially gain access to network diagrams, server inventories, and other critical infrastructure information. The lack of authentication required for exploitation significantly broadens the attack surface, making it a high-priority risk.

Organizations heavily reliant on WhatsUp Gold for network monitoring and performance management are particularly at risk. Environments with limited network segmentation or exposed monitoring servers are especially vulnerable. Shared hosting environments where multiple customers share the same WhatsUp Gold instance also face increased risk.

• windows / supply-chain:

Get-Process -Name "WhatsUpGoldService" | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='WhatsUp Gold Service']]]" -MaxEvents 10

• generic web:

curl -I https://<your_whatsupgold_server>/  # Check for unexpected responses or exposed endpoints

1. 2024-12-02Disclosure

   disclosure

1. 予約済み2024-09-13
2. 公開日2024-12-02
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-46909 is to immediately upgrade to WhatsUp Gold version 2024.0.1 or later. If upgrading is not immediately feasible, consider segmenting the WhatsUp Gold server from critical network resources to limit potential blast radius. While a direct workaround isn't available, implementing strict network access controls to restrict external access to the WhatsUp Gold server can reduce the attack surface. Monitor WhatsUp Gold logs for suspicious activity, particularly attempts to access or modify system files. After upgrading, confirm the vulnerability is resolved by attempting a test exploit (if safe to do so in a non-production environment) or verifying that the relevant code paths have been patched.