Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flaw

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability (CWE-74) in which attacker-controlled input is evaluated by the application as an OGNL expression. A remote, unauthenticated attacker can trigger the flaw by sending a crafted HTTP request that injects OGNL expressions, which the server then executes. Successful exploitation leads to remote code execution on the host running Confluence, giving the attacker control of the system without any credentials. Any organization running self-hosted Confluence Data Center or Server is potentially affected — the available data does not specify version ranges, so operators should consult Atlassian's advisory — with internet-facing instances at highest risk. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-24 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile).

Do: Patch to the fixed release specified in Atlassian's advisory immediately, prioritizing internet-exposed instances, since the flaw is in CISA's KEV with known ransomware use and carries a 100% EPSS. If patching is not immediately possible, apply the vendor's mitigations per the KEV required action — or discontinue/restrict use — for example by limiting unauthenticated access to Confluence from the internet. Review Confluence access and application logs for anomalous unauthenticated requests and indicators of command execution or ransomware activity.

CVE-2024-4885 is an unauthenticated path traversal vulnerability (CWE-22) in the WhatsUp.ExportUtilities.Export.GetFileWithoutZip function of Progress WhatsUp Gold, a network monitoring platform. An attacker can send a crafted request to the affected export/file-retrieval functionality to traverse outside the intended directory, which leads to execution of commands on the server. Successful exploitation yields remote code execution running with the privileges of the iisapppool\mconsole application pool identity, giving control of the WhatsUp Gold monitoring server and, potentially, a foothold in the network. All WhatsUp Gold versions released before 2023.1.3 are affected, meaning any organization running an unpatched on-premises deployment is exposed, especially if the web interface is reachable from untrusted networks. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-03, and its 99.3% EPSS probability reflects very high expected exploitation; no public PoC is known, though headlines indicate exploitation followed shortly after a proof-of-concept for this WhatsUp Gold flaw.

Do: Upgrade WhatsUp Gold to version 2023.1.3 or later, per Progress's advisories (which shipped patches for this and several related WhatsUp Gold flaws). Until patched, restrict access to the WhatsUp Gold web interface to trusted networks and review logs for unexpected requests to the export utility; federal agencies must apply vendor mitigations or follow BOD 22-01 guidance by the KEV due date. Because the flaw is unauthenticated and exploited in the wild, treat any internet-facing, unpatched instance as compromised until verified.

CVE-2024-6670 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) in Progress Software's WhatsUp Gold network monitoring product, affecting all versions released before 2024.0.0. An unauthenticated attacker can trigger the flaw with crafted requests sent to the product over the network, requiring no privileges or user interaction. Successful exploitation lets the attacker retrieve WhatsUp Gold users' encrypted passwords, which can then potentially be cracked offline to gain valid credentials for further compromise. All organizations running affected releases — especially those with the WhatsUp Gold interface reachable beyond trusted internal networks — are exposed, and the flaw is one of two critical WhatsUp Gold issues Progress fixed in the 2024.0.0 release. CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-16 with confirmed ransomware use, and EPSS assigns a ~93% probability of exploitation within 30 days, though no public proof-of-concept is catalogued for this flaw.

Do: Upgrade to WhatsUp Gold 2024.0.0 or later, the release that fixes this flaw; per CISA's KEV requirement, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Because the flaw exposes encrypted user passwords, reset WhatsUp Gold credentials after patching and review logs for signs of exploitation, given known ransomware use.