Critical Flaw in LoadMaster: Update Now or Face the Music

Hot Take:

Progress Software just dropped a bombshell with a severity level of 10.0! Who knew LoadMaster could turn into LoadDisaster with a little help from an improper input validation bug? Time to update before your server starts taking commands from the dark side.

Key Points:

• Progress Software addresses a critical vulnerability in LoadMaster and Multi-Tenant hypervisor.
• Flaw tracked as CVE-2024-7591 with a perfect CVSS score of 10.0.
• Unauthenticated, remote attackers can exploit the flaw to execute arbitrary OS commands.
• Affected versions: LoadMaster (7.2.60.0 and prior) and Multi-Tenant Hypervisor (7.1.35.11 and prior).
• Immediate update and adherence to security guidelines are strongly recommended.

LoadMaster or LoadDisaster?

Progress Software has dropped a critical security update for its LoadMaster and Multi-Tenant (MT) hypervisor products. The issue? A mind-boggling, maximum-severity flaw tracked as CVE-2024-7591, which apparently has a CVSS score of 10.0. Yup, that’s a perfect 10, but not the kind you want to brag about. This vulnerability lets unauthenticated, remote attackers execute arbitrary operating system commands with a carefully crafted HTTP request. It’s like giving hackers a universal remote to your server.

Patch Now or Regret Later

The flaw, an improper input validation bug, affects LoadMaster versions 7.2.60.0 and prior, and Multi-Tenant Hypervisor versions 7.1.35.11 and prior. Progress Software has assured users that the vulnerability has been tackled by sanitizing user input to prevent arbitrary system command execution. However, the company strongly advises users to update their software immediately. You don’t want to be the last one still running the old, vulnerable version when the cyber wolves come knocking.

Thank You, Florian Grunow

We owe a debt of gratitude to security researcher Florian Grunow for discovering and reporting this flaw. Progress Software has stated that there’s no evidence of the vulnerability being exploited in the wild, yet. But let’s not tempt fate, shall we? The update can be installed by navigating to System Configuration > System Administration > Update Software. It’s as simple as following a GPS route—no excuses.

Security Guidelines Are Your Friend

In addition to updating, Progress Software strongly recommends that users adhere to their security hardening guidelines. Think of these guidelines as the security equivalent of wearing a seatbelt. Sure, it might seem like an extra step now, but you’ll be thankful if you hit a bump in the cyber road. The company is encouraging all customers to upgrade their LoadMaster implementations to harden their environment against potential threats.