Progress Software program has issued an emergency repair for a most (10/10) severity vulnerability impacting its LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor merchandise that permits attackers to remotely execute instructions on the gadget.
The flaw, tracked as CVE-2024-7591, is categorized as an improper enter validation drawback permitting an unauthenticated, distant attacker to entry LoadMaster’s administration interface utilizing a specifically crafted HTTP request.
Nonetheless, the dearth of consumer enter sanitization might additionally enable the attacker to execute arbitrary system instructions on weak endpoints.
“It’s doable for unauthenticated, distant attackers who’ve entry to the administration interface of LoadMaster to situation a rigorously crafted HTTP request that can enable arbitrary system instructions to be executed,” reads the safety bulletin.
“This vulnerability has been closed by sanitizing request consumer enter to mitigate arbitrary system instructions execution.”
LoadMaster is an software supply controller (ADC) and cargo balancing resolution utilized by giant organizations for optimizing app efficiency, managing community site visitors, and making certain excessive service availability.
The MT Hypervisor is a model of LoadMaster designed for multi-tenant environments, permitting a number of digital community features to run on the identical {hardware}.
CVE-2024-7591 was discovered to influence LoadMaster model 7.2.60.0 and all earlier variations, and likewise the MT Hypervisor model 7.1.35.11 and all prior releases. Lengthy-Time period Assist (LTS) and Lengthy-Time period Assist with Characteristic (LTSF) branches are additionally impacted.
To repair the flaw, Progress launched an add-on bundle that may be put in on any of the weak variations, together with older releases, so there’s no goal variations to improve to as a way to handle the danger from this vulnerability.
Nonetheless, the patch doesn’t apply to the free model of LoadMaster, so CVE-2024-7591 stays an issue there.
Progress Software program says it has not acquired any experiences of energetic exploitation for the vulnerability as of the publication of its bulletin.
However, all LoadMaster customers are advisable to take the suitable motion to safe their surroundings in opposition to this risk, together with putting in the add-on and likewise implementing the vendor-recommended safety hardening measures.
