PT-2024-2324 · Progress · Progress Telerik Report Server

07842C0E165D4D2D8733Dd4Eab48B3Ed0F7Afe38 · Published 2024-03-20 · Updated 2025-01-16 · CVE-2024-1800

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130)

Description A remote code execution attack is possible through an insecure deserialization vulnerability in the Progress® Telerik® Report Server. This vulnerability is related to deficiencies in the deserialization mechanism, allowing a remote attacker to execute arbitrary code. Approximately 106 hosts are affected globally, with 97% of these hosts having an exposed login page and 46% having remote access capabilities.

Recommendations For versions prior to 2024 Q1 (10.0.24.130), update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the deserialization mechanism to minimize the risk of exploitation. Avoid using untrusted data in the ObjectReader deserialization process until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-02265

CVE-2024-1800

ZDI-24-403

Affected Products

Progress Telerik Report Server

References · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_report_server_deserialization.rb · Exploit
• 🔥 https://github.com/sinsinology/CVE-2024-4358 · Exploit
• https://docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-1800 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02265 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-403 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1800 · Security Note
• https://twitter.com/shah_sheikh/status/1810332786408165763 · Twitter Post
• https://twitter.com/ianbishop2021/status/1783866119834714270 · Twitter Post
• https://t.me/cybersecuritytechnologies/10625 · Telegram Post
• https://twitter.com/fofabot/status/1770742807080177807 · Twitter Post
• https://twitter.com/g7shot/status/1797939927780602019 · Twitter Post
• https://twitter.com/ntounix/status/1798946339482722544 · Twitter Post
• https://twitter.com/CCBalert/status/1772171431750594975 · Twitter Post
• https://t.me/p0x3k/1800 · Telegram Post