Telerik Report Server Auth Bypass + Deserialization

Product: Progress Telerik Report Server
CVE: CVE-2024-4358 CVE-2024-1800
Disclosed: 2024-05-29
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: <= 2024 Q1 (10.0.24.305)
Fixed: 2024 Q2 (10.1.24.514)

Summary

Sina Kheirkhah chained an initial-setup auth bypass with an insecure deserialization in report processing to get pre-auth RCE on Telerik Report Server. The bypass lets anyone register a new admin, who then uploads a malicious report definition.

Root cause

The Register method of StartupController remained callable after setup completed, letting an unauthenticated user create a System Administrator (CVE-2024-4358). Report (.trdp/.trbp) XML was deserialized with a custom serializer that resolved arbitrary types (CVE-2024-1800), enabling a ResourceDictionary/ObjectDataProvider gadget to run commands.

Impact

Unauthenticated RCE on Report Server hosts.

Public PoC

python CVE-2024-4358.py --target http://192.168.253.128:83 -c "whoami"
(*) random backdoor username: oelycslyun
(*) random backdoor password: cqgnacxljo

Source: sinsinology / CVE-2024-4358

Detection

Look for POSTs to /Startup/Register after initial setup and unexpected admin accounts or uploaded reports. nuclei template CVE-2024-4358.

Mitigation

Upgrade to 2024 Q2 (10.1.24.514)+, or apply the URL Rewrite rule blocking /Startup/Register.