Progress LoadMaster OS Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Progress LoadMaster API. This issue arises from improper input sanitization in the 'killsession' command, allowing authenticated attackers with 'All' permissions to execute arbitrary commands on the LoadMaster appliance. The vulnerability affects Progress LoadMaster GA versions through 7.2.62.2 and LTSF versions through 7.2.54.16.

Impact

Exploitation of this vulnerability allows authenticated attackers to execute arbitrary commands on the LoadMaster appliance.

Remediation

Progress LoadMaster has released a patch for this vulnerability in version 7.2.63.1 for the GA channel and 7.2.54.17 for the LTSF channel. Instructions for upgrading are available on the Progress Community LoadMaster Download Hub.