{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2024-1800/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:telerik:report_server_2024:*:*:*:*:*:*:*:*","cpe:2.3:a:progress:telerik_report_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2024-1800"},{"cvss":9.8,"id":"CVE-2024-4358"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telerik Report Server (\u003c 10.0.24.130)","Telerik Report Server (\u003c= 10.0.24.305)"],"_cs_severities":["critical"],"_cs_tags":["telerik","rce","deserialization","cve-2024-4358","cve-2024-1800"],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Telerik Report Server contains an authentication bypass vulnerability (CVE-2024-1800) that, when chained with an insecure deserialization vulnerability (CVE-2024-4358), allows unauthenticated attackers to achieve remote code execution. Exploitation involves bypassing authentication to create a backdoor account and subsequently uploading a malicious .trdp report file to the '/api/reportserver/report' endpoint, which triggers deserialization of the malicious payload. Publicly available exploit code confirms the feasibility of this attack chain.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a request to the target to initiate the authentication bypass (CVE-2024-1800).\u003c/li\u003e\n\u003cli\u003eAttacker creates a new administrative or backdoor user account on the Telerik Report Server.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates as the newly created backdoor user to obtain an access token.\u003c/li\u003e\n\u003cli\u003eAttacker uses the authenticated session to target the '/api/reportserver/report' endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious '.trdp' report file containing a serialized payload.\u003c/li\u003e\n\u003cli\u003eThe server deserializes the payload, resulting in arbitrary code execution on the underlying host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain full system access, enabling the execution of arbitrary commands, data exfiltration, or deployment of further payloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Progress Telerik Report Server to version 10.0.24.130 or higher immediately as specified in the Progress knowledge base.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unauthorized account creation events on Telerik Report Server instances.\u003c/li\u003e\n\u003cli\u003eInspect HTTP traffic to the '/api/reportserver/report' endpoint for anomalous POST requests containing serialized object patterns or suspicious filenames.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T11:13:13Z","date_published":"2026-10-24T11:13:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-telerik-rce-chain/","summary":"Progress Telerik Report Server is vulnerable to a pre-authentication remote code execution chain involving authentication bypass (CVE-2024-1800) and insecure deserialization (CVE-2024-4358) via the report management API.","title":"Progress Telerik Report Server: Pre-authentication Remote Code Execution (CVE-2024-4358 and CVE-2024-1800)","url":"https://feed.craftedsignal.io/briefs/2026-10-telerik-rce-chain/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2024-1800","version":"https://jsonfeed.org/version/1.1"}