CVE-2024-4358

🗓️ 29 May 2024 14:51:21Reported by ProgressSoftwareType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 304 Views🌐 WEB

Telerik Report Server authentication bypass CVE-2024-4358

Reporter	Title	Published	Views	Family All 41
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	4 Jun 202411:32	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	4 Jun 202416:07	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	5 Jun 202401:05	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	3 Jun 202408:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	24 Aug 202410:09	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	9 Jun 202406:30	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	24 Aug 202410:09	–	githubexploit
zdt	Telerik Report Server Authentication Bypass / Remote Code Execution Exploit	13 Jun 202400:00	–	zdt
attackerkb	CVE-2024-4358	29 May 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the Register method in the Telerik Report Server reporting framework allows a malicious actor to access limited functions.	7 Jun 202400:00	–	bdu_fstec

NVD

Vulners

Vulnrichment

Node

telerik report_server_2024Range≤10.0.24.305

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Telerik Report Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "10.1.24.514",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
docs	www.docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
reportContent	request body	/api/reportserver/report	RCE via insecure deserialization in report processing when uploading a malicious .trdp payload	CWE-290
timeStamp	request body	/api/reports/clients	Chain step to create a client for exploit; used to obtain clientId for subsequent deserialization-based RCE steps	CWE-290
report	request body	/api/reports/clients/{clientId}/parameters	Set parameters for the uploaded report to trigger deserialization-based RCE	CWE-290
parameterValues	request body	/api/reports/clients/{clientId}/parameters	Set parameters for the uploaded report to trigger deserialization-based RCE	CWE-290
Username	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290
Password	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290
ConfirmPassword	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290
Email	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290
FirstName	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290
LastName	request body	/Startup/Register	Account creation used in POC to obtain authentication token	CWE-290