CVE-2024-4358
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Description
CVE-2024-4358 is a critical authentication bypass vulnerability in Progress Telerik Report Server version 2024 Q1 (10.0.24.305) and earlier when deployed on IIS. An unauthenticated attacker can gain access to restricted functionality of Telerik Report Server by bypassing the authentication mechanism through the registration endpoint. With a CVSS v3.1 score of 9.8 and an EPSS score of 94.34% at the 100th percentile, this is one of the most actively exploited vulnerabilities tracked in 2024. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 4, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| telerik | report server 2024 | <= 10.0.24.305 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-4358. The vulnerability is an authentication bypass that allows unauthenticated users to access the Telerik Report Server registration page and create administrative accounts even when registration should be restricted. This type of flaw typically aligns with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). The root cause is that the registration endpoint in Telerik Report Server does not properly enforce authentication requirements when deployed on IIS, allowing attackers to create new accounts with administrative privileges on an already-configured server.
Impact Analysis
CVE-2024-4358 allows an unauthenticated remote attacker to bypass authentication and gain full administrative access to Telerik Report Server. The CVSS vector reflects a Network attack (AV:N) with Low complexity (AC:L), No privileges required (PR:N), and No user interaction needed (UI:N). Confidentiality (High): the attacker gains access to all reports, data connections, and potentially sensitive business data processed through the reporting server. Telerik Report Server often connects to backend databases containing financial, customer, or operational data, making the data exposure risk substantial. Integrity (High): with administrative access, the attacker can modify reports, alter data connections to exfiltrate data to attacker-controlled servers, upload malicious report definitions, and potentially achieve code execution on the server. Availability (High): the attacker can disable the reporting service, delete reports and configurations, or use the server as a pivot point for further network penetration. The EPSS score of 94.34% at the 100th percentile places this as the single most exploited vulnerability by probability, indicating active mass exploitation. The ransomware association is listed as unknown, but administrative access to enterprise reporting infrastructure provides a powerful launching point for ransomware attacks.
Exploit Maturity
CVE-2024-4358 has an extremely mature exploit landscape. CISA added it to the KEV catalog with a remediation deadline of July 4, 2024, confirming widespread active exploitation. The EPSS score of 94.34% at the 100th percentile makes this the most probable vulnerability to be exploited across all tracked CVEs, indicating mass automated scanning and exploitation. Progress published a knowledge base article documenting the vulnerability and providing mitigation guidance. The exploitation technique involves accessing the registration endpoint to create a new administrative account on an already-configured Telerik Report Server instance. This is trivially reproducible and requires no specialized tools or exploit code. The combination of unauthenticated access, low complexity, and internet-facing deployment makes Telerik Report Server installations immediate targets for opportunistic attackers.
Remediation
-
Update Telerik Report Server to a version newer than 2024 Q1 (10.0.24.305) that addresses the authentication bypass. Consult the Progress knowledge base article for the specific patched version and upgrade instructions.
-
Implement the IIS URL Rewrite mitigation as an immediate workaround if patching cannot be performed right away. The Progress advisory provides specific URL Rewrite rules that block access to the vulnerable registration endpoint while maintaining normal Report Server functionality.
-
Audit existing user accounts on all Telerik Report Server instances for unauthorized administrative accounts that may have been created through exploitation. Review account creation timestamps, access logs, and any accounts with unfamiliar usernames or email addresses.
-
Restrict network access to Telerik Report Server by placing it behind a VPN or reverse proxy with authentication. Report Server administration interfaces should never be directly accessible from the internet without additional access controls.
-
Review data connections and report definitions for unauthorized modifications. An attacker with administrative access may have altered database connection strings to exfiltrate data, modified report templates to include malicious content, or created scheduled tasks for persistent access.
Technical Details
CVE-2024-4358 is an authentication bypass vulnerability in Progress Telerik Report Server with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a score of 9.8 (Critical). The Attack Vector is Network (AV:N), as exploitation occurs through HTTP requests to the Report Server. Attack Complexity is Low (AC:L), requiring only a standard HTTP request to the registration endpoint. No privileges (PR:N) and no user interaction (UI:N) are required. The Scope is Unchanged (S:U), affecting only the Report Server context, and all three impact metrics are High. The vulnerability specifically affects Telerik Report Server when deployed on Microsoft IIS. Under normal operation, once the initial setup and account creation is complete, the registration endpoint should be restricted. However, a flaw in the authentication logic allows unauthenticated users to access the registration page and create new accounts, including accounts with administrative privileges. This effectively bypasses all authentication controls, giving the attacker full access to the Report Server management interface, report definitions, data connections, and scheduling functionality. The affected version is Telerik Report Server 2024 Q1 (10.0.24.305) and all earlier versions deployed on IIS.
Frequently Asked Questions
Is CVE-2024-4358 being actively exploited?
Yes. CVE-2024-4358 is one of the most actively exploited vulnerabilities of 2024. CISA added it to the KEV catalog, and its EPSS score of 94.34% at the 100th percentile indicates it is the most probable vulnerability to be exploited across all currently tracked CVEs.
What versions of Telerik Report Server are affected?
All versions of Telerik Report Server up to and including version 2024 Q1 (10.0.24.305) are affected when deployed on Microsoft IIS. The vulnerability does not apply to other deployment configurations.
How does the CVE-2024-4358 attack work?
An unauthenticated attacker accesses the Telerik Report Server registration endpoint, which should be restricted after initial setup but is not properly protected. The attacker creates a new account with administrative privileges, gaining full access to the Report Server without any credentials.
Is CVE-2024-4358 linked to ransomware?
The ransomware association is currently listed as unknown. However, gaining administrative access to an enterprise reporting server that connects to backend databases provides attackers with significant lateral movement opportunities and makes ransomware deployment a realistic next step.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.