CVE-2024-4358

What it actually does

CVE-2024-4358 is a network-exploitable authentication bypass in Progress Telerik Report Server 2024 Q1 10.0.24.305 and earlier when hosted on IIS. An unauthenticated remote attacker can bypass normal access controls and reach restricted Report Server functionality without valid credentials. Once authenticated controls are reachable, the attacker may be able to create or modify users, access reports and data source configuration, change server settings, and use the compromised application context as a foothold for further attacks. The high CVSS score reflects full confidentiality, integrity, and availability impact: the flaw can expose sensitive report data and connection details, allow unauthorized administrative changes, and potentially enable service disruption or follow-on exploitation when chained with other Telerik Report Server vulnerabilities.

Why it matters to the business

A vulnerable internet-facing Telerik Report Server can be taken over without a valid login, exposing business reports, stored data source details, and administrative controls. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a very high EPSS probability, affected organizations should treat it as an urgent exposure rather than a theoretical risk. Compromise could lead to leakage of sensitive operational data, unauthorized changes to reporting workflows, credential theft from configured data sources, downtime of reporting services, and a platform for broader intrusion into connected systems.

How an attack unfolds

An attacker first identifies a reachable Telerik Report Server instance, commonly by fingerprinting IIS-hosted Report Server pages, static assets, titles, or API responses. If the instance is version 2024 Q1 10.0.24.305 or earlier, the attacker sends crafted unauthenticated HTTP requests that exploit the authentication bypass and cause the server to treat the request as authorized or to expose functionality that should require a valid session. With access to restricted functionality, the attacker can enumerate configuration, create or modify users, assign administrative privileges, access reports, inspect data source definitions, and change application settings. In higher-impact intrusions, the attacker may use the newly obtained application access to harvest credentials, alter report content, stage persistence through new accounts, or chain the bypass with an authenticated Telerik Report Server vulnerability to execute code under the IIS application context. Post-exploitation activity may include abnormal administrative actions, suspicious POST requests to user or configuration endpoints, and child processes spawned by the IIS worker process.

How to fix it

Upgrade Progress Telerik Report Server to a vendor-supported fixed release newer than 2024 Q1 10.0.24.305, preferably the latest available Telerik Report Server release. Progress addressed the issue after the affected 2024 Q1 release line; organizations should follow the vendor advisory and install the current build rather than relying on partial configuration changes. If immediate upgrade is not possible, remove Report Server from direct internet exposure, restrict access to trusted VPN or administrative networks, enforce IIS IP allowlisting, place the application behind authenticated reverse proxy controls, and monitor or block unauthenticated access to administrative/API endpoints. After patching, review and remove unauthorized Report Server users and roles, rotate credentials used by configured report data sources, rotate any service credentials exposed to the application, and review reports, data sources, schedules, and server settings for tampering.

How to confirm the fix worked

Confirm every Telerik Report Server instance is running a release newer than 2024 Q1 10.0.24.305 or the latest vendor-supported version. Validate both the installed product version and the deployed IIS application files, because stale web files may remain after incomplete upgrades. From an unauthenticated browser or test client, verify that administrative pages, user management functions, data source configuration, and API endpoints require authentication and do not return successful 200-series responses or privileged data. Review IIS bindings, firewall rules, and reverse proxy configuration to ensure access is limited as intended. Perform a post-upgrade application smoke test for login, report rendering, scheduling, and data source access, then run vulnerability scanning or authenticated asset inventory to confirm no vulnerable builds remain.

Typical attack path

1. Scan the internet or target network for IIS-hosted Progress Telerik Report Server instances.
2. Fingerprint the Report Server version or infer vulnerable builds from exposed assets and responses.
3. Send crafted unauthenticated HTTP requests that trigger the authentication bypass.
4. Access restricted Report Server functions without valid credentials.
5. Create or modify Report Server users, roles, reports, data sources, or settings.
6. Extract sensitive report content, connection metadata, or stored configuration.
7. Optionally chain the unauthorized access with another authenticated vulnerability or administrative feature to gain code execution or deeper persistence.
8. Cover tracks by deleting or altering application objects, logs, or newly created accounts.

How to detect it

To determine whether exploitation already occurred, review IIS access logs, Telerik Report Server application logs, Windows Security logs, Windows process creation telemetry, EDR alerts, reverse proxy/WAF logs, and any database or configuration audit logs associated with Report Server. Look for successful unauthenticated or pre-authentication requests to restricted pages or API endpoints, especially POST requests that create users, change roles, alter settings, or access data source configuration. Compare the timing of any new Report Server accounts, administrator role assignments, report changes, data source edits, and schedule modifications against known maintenance windows. Investigate requests from unfamiliar internet IPs, unusual user agents, missing or abnormal authentication cookies, and sequences where privileged actions occur without a preceding successful login. Because this flaw may be chained for deeper compromise, hunt for IIS worker process child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, or wget.exe; unexpected files written under the Report Server installation, IIS web root, Windows temp directories, or ASP.NET temporary compilation directories; and outbound connections from the Report Server host to unfamiliar infrastructure. If active exploitation is suspected, preserve logs and disk images before remediation where possible, disable public access, rotate Report Server and data source credentials, and review all administrative changes since at least the vulnerability publication date of 2024-05-29.

• /Account/Register
• /Account/Login
• /api/users
• /api/user
• /api/roles
• /api/datasources
• /api/reports
• /api/settings
• Telerik.ReportServer.Web
• Progress Telerik Report Server
• C:\Program Files (x86)\Progress\Telerik Report Server
• C:\Program Files\Progress\Telerik Report Server
• w3wp.exe
• w3wp.exe cmd.exe
• w3wp.exe powershell.exe
• w3wp.exe pwsh.exe
• w3wp.exe rundll32.exe
• w3wp.exe mshta.exe
• w3wp.exe certutil.exe
• w3wp.exe bitsadmin.exe
• w3wp.exe curl.exe
• w3wp.exe wget.exe
• C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
• C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files

What your security team should do

• Patch or upgrade all Telerik Report Server deployments above 2024 Q1 10.0.24.305 immediately; this is a KEV-listed vulnerability with active exploitation and a CISA remediation deadline of 2024-07-04.
• Prioritize internet-facing and partner-accessible Report Server instances for emergency remediation or isolation.
• If patching cannot be completed immediately, restrict access at the network layer to trusted administrative sources only and block public access.
• Hunt for exploitation before and after patching, focusing on unauthenticated requests to restricted endpoints, unexpected account creation, role changes, and configuration access.
• Review all Report Server users, roles, API/configuration changes, reports, schedules, and data sources for unauthorized modifications.
• Rotate credentials stored in or used by Telerik Report Server data sources, especially if exploitation is suspected.
• Monitor IIS worker process behavior for command execution, script interpreters, archive tools, download utilities, or outbound network connections.
• Add detections for suspicious Report Server administrative actions from unknown IP addresses, unusual user agents, or sessions lacking a normal login sequence.
• Preserve IIS logs, application logs, Windows event logs, and relevant forensic artifacts before rebuilding or upgrading systems that may have been compromised.