www.belgium.be Logo of the federal government

WARNING: CRITICAL AND HIGH VULNERABILITIES IN PROGRESS TELERIK CAN BE EXPLOITED TO EXECUTE CODE. PATCH IMMEDIATELY!

Reference: 
Advisory #2024-61
Version: 
1.0
Affected software: 
Progress Telerik Reporting
Progress Telerik Report Server
Type: 
Code Execution
CVE/CVSS: 

CVE-2024-1800
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVE-2024-1801
CVSS: 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L)

CVE-2024-1856
CVSS: 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Date: 
26/04/2024

Sources

Risks

On 20 March 2024 Progress disclosed 3 vulnerabilities in Progress Telerik Reporting and Progress Telerik Report Server (CVE-2024-1800, CVE-2024-1801 and CVE-2024-1856).

There is no information as of yet that these vulnerabilities are being actively exploited (cutoff date: 26 April 2024). However, ransomware groups have been known to exploit vulnerabilities in Progress

software in the past. It is the case for instance of Cl0p ransomware, which compromised over 2.300 organizations using a vulnerability (CVE-2023-34362) in Progress MOVEit[1].

Exploitation of these vulnerabilities have a high impact on confidentiality, and a low to high impact on integrity and availability depending on the precise vulnerability being exploited. 

 

Description

CVE-2024-1856 and CVE-2024-1801 are both insecure deserialization vulnerabilities in Progress Telerik Reporting. Exploitation of any of these vulnerabilities could enable an attacker to execute code. CVE-2024-1801 can be exploited by a local attacker. In the case of CVE-2024-1856, a remote attacker could successfully exploit it under a special set of circumstances in a misconfigured web application.

CVE-2024-1800 is an insecure deserialization vulnerability. If successfully exploited, a remote attacker could perform remote code execution.

Recommended Actions

Patch

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority, after thorough testing.

Please note Progress Telerik specifically reported that upgrading to the latest version (10.0.24.305) is the only way to remove these vulnerabilities. 

Monitor/Detect

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via: https://cert.be/en/report-incident
 
While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.

References