CVE-2024-4358, CVE-2024-1800: Exploit Code Available for Critical Exploit Chain in Progress Telerik Report Server
Researchers have released an exploit chain to achieve remote code execution on unpatched instances of Progress Telerik Report Server. Immediate patching is recommended.
Background
On May 31, security researcher Sina Kheirkhah of the Summoning Team posted on X (formerly known as Twitter) the discovery of an exploit chain involving two vulnerabilities in Progress Telerik Report Server, a report management solution.
🚨🚨🚨 (CVE-2024-4358) I've exploited a chain of bugs allowing Authentication Bypass 🔥 and eventually Remote Code Execution🩸targeting the famous Telerik Report Server, The PoC and the Writeup are being dropped very soon 🪲https://t.co/E6VTmMGGmi pic.twitter.com/4QvRfEXs8l
— SinSinology (@SinSinology) May 31, 2024
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2024-1800 | Progress Telerik Report Server Insecure Deserialization Vulnerability | 9.9 |
| CVE-2024-4358 | Progress Telerik Report Server Authentication Bypass Vulnerability | 9.8 |
On June 3, Kheirkhah published a blog post detailing how he and security researcher Soroush Dalili were able to chain together the two vulnerabilities to achieve full remote code execution (RCE). Kheirkhah notes his interest in this target arose from an incorrectly scored deserialization vulnerability (CVE-2024-1800) from the vendor. While the vendor scored this as a CVSS 9.9, indicating that no authentication is needed, the advisory from Trend Micro’s Zero Day Initiative (ZDI) suggests that a low privileged user is required. After Kheirkhah was able to identify an authentication bypass issue (CVE-2024-4358), he worked with Dalili to “complete the deserialization chain” to combine both flaws to achieve RCE.
Analysis
CVE-2024-1800 is an insecure deserialization vulnerability in Progress’ Telerik Report Server. The vulnerability was found in the ObjectReader class and is caused by improper validation of user-supplied input. When exploited, an attacker could execute code as the SYSTEM user. This flaw was reported to Progress via the ZDI and tracked as ZDI-24-403. This vulnerability has been assigned a CVSS score of 9.9 by the vendor and 8.8 by the ZDI, who worked with the anonymous researcher to responsibly disclose this flaw.
CVE-2024-4358 is an authentication bypass vulnerability in Progress’ Telerik Report Server. According to ZDI-24-561, the flaw exists due to a lack of validation of the current installation step in the Register method. This vulnerability has been assigned a CVSS score of 9.8 from both the vendor and the ZDI.
Insecure endpoint enables ability to create users with admin privileges
According to Kheirkhah, an endpoint used for setting up the Progress Telerik Report Server lacks any authentication and can still be accessed by an unauthenticated attacker “even after the admin has finished the setup process.” This is what enables an attacker to bypass authentication and create a user with system administrator privileges on the server.
Chaining authentication bypass with insecure deserialization
By combining the authentication bypass flaw (CVE-2024-4358) with the previously disclosed insecure deserialization vulnerability (CVE-2024-1800) as part of an exploit chain to create a malicious report, an attacker could execute arbitrary code on a vulnerable Progress Telerik Report Server.
Telerik flaws historically targeted by attackers
Previously, attackers have exploited multiple flaws in Telerik UI for ASP.NET AJAX:
| CVE | Description | Details |
|---|---|---|
| CVE-2019-18935 | Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | |
| CVE-2017-11317 | Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability | U.S. Gov’t IIS Server |
| CVE-2017-11357 | Telerik UI for ASP.NET AJAX Arbitrary File Upload Vulnerability | U.S. Gov’t IIS Server |
Additionally, other solutions by Progress have been targeted by attackers, including the MOVEit Transfer flaw (CVE-2023-34362) and in WS_FTP Server.
Historical exploitation of flaws in Telerik and other Progress products indicates that we may see exploit-related activity associated with this exploit chain in the near future, which is why we strongly advise patching these flaws as soon as possible.
Proof of concept
A proof-of-concept (PoC) script was published to GitHub on June 3. An attacker could use this exploit script to exploit both the authentication bypass and insecure deserialization flaws as part of the exploit chain to achieve RCE.
Solution
CVE-2024-1800 was previously addressed in Report Server 2024 Q1 (10.0.24.305). However CVE-2024-4358 was discovered after this release and was fixed as part of Report Server 2024 Q2 (10.1.24.514) which addresses both of these flaws. We recommend updating to the latest version of Progress Telerik Report Server to ensure your systems are up to date.
Identifying affected systems
A list of Tenable plugins for this vulnerability can be found on the individual CVE pages for CVE-2024-1800 and CVE-2024-4358 as they’re released. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Get more information
- Summoning Team Blog Post: Molding lies into reality || Exploiting CVE-2024-4358
- Telerik Report Server Advisory: Insecure Deserialization Vulnerability
- Telerik Report Server Advisory: Authentication Bypass Vulnerability
- ZDI Advisory ZDI-24-403: Progress Software Telerik Report Server ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability
- ZDI Advisory ZDI-24-561: Progress Software Telerik Reporting Register Authentication Bypass Vulnerability
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Related Articles
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
- Exposure Management
- Vulnerability Management
- Exposure Management
- Vulnerability Management