Security Breach for Vital Threat in Progress Telerik Report Server

Pierluigi Paganini
June 04, 2024

Scholars Published Exploit Code for a Critical Flaw on Progress Telerik Report Servers.

Researchers shared a proof-of-concept (PoC) exploit code for a serious security vulnerability on Progress Telerik Report Servers. This server solution is designed by Progress® Telerik to manage reports end-to-end.

Cybersecurity expert Sina Kheirkha initiated the investigation after examining a notification from Progress concerning a deserialization problem identified as CVE-2024-4358 (CVSS rating: 9.8). Observing that exploiting the issue necessitated authentication, he collaborated with Soroush Dalili (@irsdl) to connect the deserialization problem with an authentication workaround for complete unauthenticated RCE (Remote Code Execution).

The researchers combined this problem with a deserialization vulnerability CVE-2024-1800 (CVSS score: 8.8) to run arbitrary code on susceptible servers.

An unauthorized attacker could misuse this flaw to access confined functionalities in Telerik Report Server via an authentication bypass vulnerability.

The researchers illustrated how they could create an administrator account by exploiting the bypass issue CVE-2024-4358.

“The flaw is straightforward, the endpoint responsible for initializing the server after the initial setup can be accessed without authentication even after the admin completes the setup process.” said the expert. “The vulnerability lies within the method Telerik.ReportServer.Web.dll!Telerik.ReportServer.Web.Controllers.StartupController.Register”

An unauthorized attacker can call the Register method and utilize the parameters received to establish a user with the role of “System Administrator.”

“This method is accessible without authentication. It utilizes the provided parameters to first create a user, followed by assigning the “System Administrator” role, enabling a remote unauthorized attacker to create an administrator user and sign in :))))))” the expert added.

The vulnerability affects Telerik Report Server 2024 Q1 (10.0.24.305) and earlier versions. Progress resolved this issue by releasing Telerik Report Server 2024 Q2 10.1.24.514 on May 15.

“The only solution to eliminate this vulnerability is by updating to Report Server 2024 Q2 (10.1.24.514) or a later version. It is strongly advised by the Progress Telerik team to upgrade to the latest version specified in the table below.” stated the vendor.

Experts strongly recommend organizations to promptly update their installations due to the PoC exploit code being accessible.

Pierluigi Paganini

Stay connected on Twitter: @securityaffairs, Facebook, and Mastodon

(SecurityAffairs – hacking, RCE)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts