Researchers have released an exploit chain to achieve remote code execution on unpatched instances of Progress Telerik Report Server. Immediate patching is recommended.
Background
On May 31, security researcher Sina Kheirkhah of the Summoning Team posted on X (formerly known as Twitter) the discovery of an exploit chain involving two vulnerabilities in Progress Telerik Report Server, a report management solution.
🚨🚨🚨 (CVE-2024-4358) I've exploited a chain of bugs allowing Authentication Bypass 🔥 and eventually Remote Code Execution🩸targeting the famous Telerik Report Server, The PoC and the Writeup are being dropped very soon 🪲https://t.co/E6VTmMGGmipic.twitter.com/4QvRfEXs8l
— SinSinology (@SinSinology) May 31, 2024
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2024-1800 | Progress Telerik Report Server Insecure Deserialization Vulnerability | 9.9 |
| CVE-2024-4358 | Progress Telerik Report Server Authentication Bypass Vulnerability | 9.8 |
On June 3, Kheirkhah published a blog post detailing how he and security researcher Soroush Dalili were able to chain together the two vulnerabilities to achieve full remote code execution (RCE). Kheirkhah notes his interest in this target arose from an incorrectly scored deserialization vulnerability (CVE-2024-1800) from the vendor. While the vendor scored this as a CVSS 9.9, indicating that no authentication is needed, the advisory from Trend Micro’s Zero Day Initiative (ZDI) suggests that a low privileged user is required. After Kheirkhah was able to identify an authentication bypass issue (CVE-2024-4358), he worked with Dalili to “complete the deserialization chain” to combine both flaws to achieve RCE.
Analysis
CVE-2024-1800 is an insecure deserialization vulnerability in Progress’ Telerik Report Server. The vulnerability was found in the ObjectReader class and is caused by improper validation of user-supplied input. When exploited, an attacker could execute code as the SYSTEM user. This flaw was reported to Progress via the ZDI and tracked as ZDI-24-403. This vulnerability has been assigned a CVSS score of 9.9 by the vendor and 8.8 by the ZDI, who worked with the anonymous researcher to responsibly disclose this flaw.
CVE-2024-4358 is an authentication bypass vulnerability in Progress’ Telerik Report Server. According to ZDI-24-561, the flaw exists due to a lack of validation of the current installation step in the Register method. This vulnerability has been assigned a CVSS score of 9.8 from both the vendor and the ZDI.
Insecure endpoint enables ability to create users with admin privileges
According to Kheirkhah, an endpoint used for setting up the Progress Telerik Report Server lacks any authentication and can still be accessed by an unauthenticated attacker “even after the admin has finished the setup process.” This is what enables an attacker to bypass authentication and create a user with system administrator privileges on the server.
Chaining authentication bypass with insecure deserialization
By combining the authentication bypass flaw (CVE-2024-4358) with the previously disclosed insecure deserialization vulnerability (CVE-2024-1800) as part of an exploit chain to create a malicious report, an attacker could execute arbitrary code on a vulnerable Progress Telerik Report Server.
Telerik flaws historically targeted by attackers
Previously, attackers have exploited multiple flaws in Telerik UI for ASP.NET AJAX:
| CVE | Description | Details |
|---|---|---|
| CVE-2019-18935 | Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | |
| CVE-2017-11317 | Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability | U.S. Gov’t IIS Server |
| CVE-2017-11357 | Telerik UI for ASP.NET AJAX Arbitrary File Upload Vulnerability | U.S. Gov’t IIS Server |
Additionally, other solutions by Progress have been targeted by attackers, including the MOVEit Transfer flaw (CVE-2023-34362) and in WS_FTP Server.
Historical exploitation of flaws in Telerik and other Progress products indicates that we may see exploit-related activity associated with this exploit chain in the near future, which is why we strongly advise patching these flaws as soon as possible.
Proof of concept
A proof-of-concept (PoC) script was published to GitHub on June 3. An attacker could use this exploit script to exploit both the authentication bypass and insecure deserialization flaws as part of the exploit chain to achieve RCE.
Solution
CVE-2024-1800 was previously addressed in Report Server 2024 Q1 (10.0.24.305). However CVE-2024-4358 was discovered after this release and was fixed as part of Report Server 2024 Q2 (10.1.24.514) which addresses both of these flaws. We recommend updating to the latest version of Progress Telerik Report Server to ensure your systems are up to date.
Identifying affected systems
A list of Tenable plugins for this vulnerability can be found on the individual CVE pages for CVE-2024-1800 and CVE-2024-4358 as they’re released. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Get more information
- Summoning Team Blog Post: Molding lies into reality || Exploiting CVE-2024-4358
- Telerik Report Server Advisory: Insecure Deserialization Vulnerability
- Telerik Report Server Advisory: Authentication Bypass Vulnerability
- ZDI Advisory ZDI-24-403: Progress Software Telerik Report Server ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability
- ZDI Advisory ZDI-24-561: Progress Software Telerik Reporting Register Authentication Bypass Vulnerability
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
