PT-2024-3990 · Progress · Progress Telerik Report Server

Sina Kheirkhah · Published 2024-03-20 · Updated 2026-03-04 · CVE-2024-4358

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Telerik Report Server versions 2024 Q1 (10.0.24.305) or earlier

Description The issue is related to an authentication bypass vulnerability in Progress Telerik Report Server, allowing an unauthenticated attacker to gain access to restricted functionality. This can be exploited by spoofing, potentially granting unauthorized access to sensitive data. There have been reports of exploitation attempts, with some sources indicating that high-level cybercriminals are targeting Progress Software products. It is estimated that a significant number of devices may be affected, although the exact number is not specified.

Recommendations For versions 2024 Q1 (10.0.24.305) or earlier, update to version 10.1.24.514 or higher immediately to resolve the issue. As a temporary workaround, consider restricting access to the Report Server until the update can be applied. Additionally, review user lists for unknown accounts, as exploitation of this vulnerability could allow attackers to create rogue admin users.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-502

CWE-290

Related Identifiers

BDU:2024-02265

BDU:2024-04405

CVE-2024-4358

ZDI-24-561

Affected Products

Progress Telerik Report Server

References · 64

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/telerik_report_server_auth_bypass.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_report_server_deserialization.rb · Exploit
• 🔥 https://github.com/sinsinology/CVE-2024-4358 · Exploit
• 🔥 https://github.com/Sk1dr0wz/CVE-2024-4358_Mass_Exploit · Exploit
• 🔥 https://github.com/verylazytech/CVE-2024-4358 · Exploit
• 🔥 https://github.com/RevoltSecurities/CVE-2024-4358 · Exploit
• 🔥 https://github.com/gh-ost00/CVE-2024-4358 · Exploit
• 🔥 https://github.com/fa-rrel/CVE-2024-4358 · Exploit
• 🔥 https://exploit-db.com/exploits/52103 · Exploit
• https://bdu.fstec.ru/vul/2024-02265 · Security Note
• https://bdu.fstec.ru/vul/2024-04405 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4358 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-561 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4358 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358 · Note