OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
An attacker can run harmful commands on Progress LoadMaster devices without logging in, by sending specially crafted requests to the API. This allows complete control of the affected systems.
OS command injection vulnerability in Progress ADC API endpoints due to insufficient input sanitization. Un-authenticated attackers can execute arbitrary OS commands via malicious payloads in multiple command endpoints, achieving remote code execution with system-level privileges.