CVE-2020-0618
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
Description
CVE-2020-0618 is a high-severity remote code execution vulnerability in Microsoft SQL Server Reporting Services (SSRS) that allows authenticated attackers to execute arbitrary code on the server. The flaw exists in how SSRS handles page requests, specifically through insecure deserialization of ViewState data. Affecting SQL Server 2012, 2014, and 2016, this vulnerability carries a CVSS score of 8.8 and an EPSS probability of 94.25% (99.9th percentile), indicating near-certain exploitation. CISA has listed it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 9, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sql server | 2012; 2014; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2020-0618 by NVD. The vulnerability stems from insecure deserialization of ASP.NET ViewState in SQL Server Reporting Services. SSRS uses serialized ViewState to maintain page state between requests, and when the machine key used to protect ViewState is known or extractable, an attacker can craft a malicious serialized payload that executes arbitrary code upon deserialization by the server. This is a well-understood pattern in ASP.NET applications where ViewState validation is improperly configured or where machine keys are predictable or disclosed through other vulnerabilities.
Impact Analysis
The impact of CVE-2020-0618 is significant across all security dimensions, though it requires low-level authenticated access. Confidentiality is fully compromised, giving attackers access to all data within the SQL Server instance, including reports containing sensitive business intelligence, financial data, personal information, and database connection credentials stored in SSRS data sources. Integrity faces complete compromise as attackers can modify reports, alter data source configurations, plant backdoors in the server, and manipulate any data accessible through the SSRS service account. Availability is fully at risk since exploitation can lead to service disruption, resource exhaustion, or complete server takeover.
While the vulnerability requires low-privilege authentication (PR:L), SSRS instances often have broad user access within organizations, and service accounts used by SSRS frequently have elevated database permissions. The EPSS score of 94.25% (99.9th percentile) indicates this is one of the most actively exploited vulnerabilities tracked. Public exploit code is readily available on Packet Storm Security, dramatically lowering the barrier to exploitation. The KEV entry notes ransomware association as "Unknown," but the remote code execution capability on a database server makes it a prime target for ransomware operators seeking high-value data.
Exploit Maturity
CVE-2020-0618 has reached full exploit maturity with publicly available exploit code and confirmed active exploitation in the wild. CISA's inclusion of this vulnerability in the KEV catalog with a deadline of October 9, 2024, confirms ongoing exploitation. The EPSS score of 94.25% (99.9th percentile) places it among the most likely-to-be-exploited vulnerabilities globally. Multiple public exploit packages are available, including detailed ViewState deserialization exploits on Packet Storm Security for SSRS ViewState deserialization and a dedicated SSRS 2016 RCE exploit. These publicly available exploits include step-by-step instructions and ready-to-use payloads, making exploitation accessible even to less skilled attackers. The ransomware association in the KEV catalog is listed as "Unknown," but the combination of database server access and publicly available exploits makes this an attractive target for financially motivated threat actors.
Remediation
-
Apply Microsoft's security update from the February 2020 Patch Tuesday release immediately. Download the appropriate patch for your SQL Server version from the Microsoft Security Response Center and follow Microsoft's installation guidance for SSRS updates.
-
Restrict network access to SSRS by ensuring the Reporting Services web portal and web service URLs are not exposed to the internet. Place SSRS behind a reverse proxy or VPN and limit access to authorized internal networks and users only.
-
Review and rotate machine keys used by the SSRS ASP.NET application. Ensure machine keys are unique, cryptographically strong, and not shared across environments. Verify that ViewState validation is properly configured in the SSRS web.config.
-
Audit SSRS user accounts and permissions to enforce the principle of least privilege. Remove unnecessary user access, review data source credentials, and ensure the SSRS service account runs with minimal required permissions rather than administrative database access.
-
Monitor for indicators of compromise on SQL Server instances running SSRS, including unusual process execution from the SSRS worker process, unexpected network connections, new scheduled tasks, and modifications to SSRS configuration files. Review Windows event logs and SQL Server audit logs for suspicious activity.
Technical Details
CVE-2020-0618 carries a CVSS v3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vector analysis reveals: Attack Vector (AV:N) confirms network-based exploitation. Attack Complexity (AC:L) means the attack is straightforward to execute. Privileges Required (PR:L) indicates that a low-privileged authenticated account is needed, such as any user with SSRS browse permissions. User Interaction (UI:N) means no victim interaction is required. Scope (S:U) indicates impact is contained to the SSRS/SQL Server security boundary. All impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated High.
The attack exploits ASP.NET ViewState deserialization in SQL Server Reporting Services. SSRS uses serialized ViewState to persist page state in HTTP requests. The attacker first obtains or derives the ASP.NET machine key, which can be extracted from the SSRS configuration or through information disclosure vulnerabilities. With the machine key, the attacker crafts a malicious serialized .NET object and signs it with the correct validation key. When submitted to the SSRS web interface as a ViewState parameter, the server validates the MAC signature, deserializes the payload, and executes the embedded code within the context of the SSRS application pool, typically running with elevated SQL Server access.
Frequently Asked Questions
What is CVE-2020-0618?
CVE-2020-0618 is a remote code execution vulnerability in Microsoft SQL Server Reporting Services (SSRS) that exploits insecure deserialization of ASP.NET ViewState. It affects SQL Server 2012, 2014, and 2016, allowing authenticated attackers to execute arbitrary code on the server.
Do I need special privileges to exploit this vulnerability?
The vulnerability requires only low-level authentication (any valid SSRS user account). Since many organizations grant broad SSRS access for report viewing, a large number of users could potentially exploit this flaw. Even a compromised low-privilege account is sufficient for exploitation.
Are there public exploits available for CVE-2020-0618?
Yes, multiple public exploits are available on Packet Storm Security and other security research platforms. These exploits provide detailed instructions for ViewState deserialization attacks against SSRS, making the vulnerability accessible to a wide range of attackers.
How can I verify if my SQL Server is patched against this vulnerability?
Check the installed SQL Server build number against Microsoft's documentation. The February 2020 cumulative update for SQL Server 2012, 2014, and 2016 addresses this vulnerability. You can verify the build number by running SELECT @@VERSION in SQL Server Management Studio and comparing it to the patched version listed in Microsoft's advisory.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.