Progress Telerik Report Server: Pre-authentication Remote Code Execution (CVE-2024-4358 and CVE-2024-1800)

Progress Telerik Report Server contains an authentication bypass vulnerability (CVE-2024-1800) that, when chained with an insecure deserialization vulnerability (CVE-2024-4358), allows unauthenticated attackers to achieve remote code execution. Exploitation involves bypassing authentication to create a backdoor account and subsequently uploading a malicious .trdp report file to the '/api/reportserver/report' endpoint, which triggers deserialization of the malicious payload. Publicly available exploit code confirms the feasibility of this attack chain.

Attack Chain

1. Attacker sends a request to the target to initiate the authentication bypass (CVE-2024-1800).
2. Attacker creates a new administrative or backdoor user account on the Telerik Report Server.
3. Attacker authenticates as the newly created backdoor user to obtain an access token.
4. Attacker uses the authenticated session to target the '/api/reportserver/report' endpoint.
5. Attacker uploads a malicious '.trdp' report file containing a serialized payload.
6. The server deserializes the payload, resulting in arbitrary code execution on the underlying host.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full system access, enabling the execution of arbitrary commands, data exfiltration, or deployment of further payloads.

Recommendation

• Upgrade Progress Telerik Report Server to version 10.0.24.130 or higher immediately as specified in the Progress knowledge base.
• Monitor logs for unauthorized account creation events on Telerik Report Server instances.
• Inspect HTTP traffic to the '/api/reportserver/report' endpoint for anomalous POST requests containing serialized object patterns or suspicious filenames.