Analysis Summary

A maximum severity vulnerability affecting Progress Software's LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor products has been fixed urgently. The vulnerability lets attackers remotely execute commands on the device.

This vulnerability, identified as CVE-2024-7591, is classified as an inappropriate input validation issue that makes it possible for a remote, unauthenticated attacker to get access to LoadMaster's administration interface by crafting a certain HTTP request. On vulnerable endpoints, however, the attacker might also be able to run arbitrary system commands due to the absence of user input sanitization.

The security bulletin says that unauthorized remote attackers with access to LoadMaster's administration interface may be able to send a carefully constructed HTTP request that permits the execution of arbitrary system commands. By sanitizing request user input to prevent the execution of unauthorized system commands, this vulnerability has been closed.

Large enterprises utilize LoadMaster, an application delivery controller (ADC) and load balancing technology, to manage network traffic, optimize app performance, and guarantee high service uptime. A variant of LoadMaster called the MT Hypervisor is intended for multi-tenant setups and permits the operation of several virtual network functions on the same hardware. It was discovered that CVE-2024-7591 affects both the MT Hypervisor version 7.1.35.11 and all earlier releases, as well as LoadMaster version 7.2.60.0 and all previous versions. Additionally affected are the Long-Term Support (LTS) and Long-Term Support with Feature (LTSF) branches.

Rather than requiring an upgrade to address the risk posed by this vulnerability, Progress fixed the defect by releasing an add-on package that may be loaded on any vulnerable version, even previous releases. But the patch isn't available for LoadMaster's free edition, therefore CVE-2024-7591 is still an issue there.

As of the bulletin's release, Progress Software claims to have received no reports of active exploitation of the issue. However, it is advised that all LoadMaster customers take the necessary steps to protect their environment from this potential, such as installing the add-on and putting the vendor-recommended security hardening measures into place.

Impact

• Remote Code Execution
• Unauthorized Access

Indicators of Compromise

CVE

• CVE-2024-7591

Affected Vendors

Remediation

• Organizations must test their assets for the vulnerability mentioned above and apply the available security patch or mitigation steps as soon as possible.
• Implement multi-factor authentication to add an extra layer of security to login processes.
• Regularly monitor network activity for any unusual behavior, as this may indicate that a cyberattack is underway.
• Organizations must stay vigilant and follow best practices for cybersecurity to protect their systems and data from potential threats. This includes regularly updating software and implementing strong access controls and monitoring tools.
• Develop a comprehensive incident response plan to respond effectively in case of a security breach or data leakage.
• Maintain regular backups of critical data and systems to ensure data recovery in case of a security incident.
• Adhere to security best practices, including the principle of least privilege, and ensure that users and applications have only the necessary permissions.
• Establish a robust patch management process to ensure that security patches are evaluated, tested, and applied promptly.
• Conduct security audits and assessments to evaluate the overall security posture of your systems and networks.
• Implement network segmentation to contain and isolate potential threats to limit their impact on critical systems.