CVE-2024-1856: Progress Telerik Reporting RCE Vulnerability

CVE-2024-1856 Overview

CVE-2024-1856 is an insecure deserialization vulnerability in Progress Telerik Reporting affecting all versions prior to 2024 Q1 (18.0.24.130). A remote authenticated attacker can execute arbitrary code on the target server by supplying crafted serialized data to the reporting engine. The flaw is classified under CWE-502: Deserialization of Untrusted Data. Progress published a knowledge base advisory describing the issue and the fixed release.

Critical Impact
Successful exploitation grants remote code execution on hosts running vulnerable Telerik Reporting instances, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Progress Telerik Reporting versions prior to 2024 Q1 (18.0.24.130)
Deployments exposing the Telerik Reporting REST service endpoint
Applications embedding vulnerable Telerik Reporting assemblies

Discovery Timeline

2024-03-20 - CVE-2024-1856 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1856

Vulnerability Analysis

The vulnerability resides in how Telerik Reporting processes serialized objects received from clients. The reporting component deserializes attacker-controlled input without adequately validating the object graph or restricting allowed types. An authenticated attacker with low privileges can craft a malicious payload that instantiates dangerous gadget chains during deserialization, resulting in arbitrary code execution in the context of the Telerik Reporting process.

The attack requires network access to the reporting service and low complexity to execute. No user interaction is needed, and the impact spans confidentiality, integrity, and availability of the host. Progress addressed the issue in Telerik Reporting 2024 Q1 (18.0.24.130) alongside the related CVE-2024-1801.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502]. Telerik Reporting accepts serialized data structures over its service interface and reconstructs .NET objects without a strict allowlist of permitted types. Attackers can leverage known .NET deserialization gadgets to trigger method invocations during object reconstruction.

Attack Vector

Exploitation is network-based and requires low privileges on the target Telerik Reporting service. The attacker submits a crafted request containing a serialized payload to the reporting endpoint. When the service deserializes the payload, gadget chains embedded in the object stream execute attacker-supplied code within the service process, typically leading to command execution on the underlying host.

See the Progress Telerik advisory for vendor technical detail.

Detection Methods for CVE-2024-1856

Indicators of Compromise

Unexpected child processes spawned by the Telerik Reporting service host (for example cmd.exe, powershell.exe, or w3wp.exe invoking shells).
Outbound network connections from the reporting service host to unfamiliar or non-corporate destinations.
Anomalous requests to Telerik Reporting REST endpoints containing large binary or Base64-encoded payloads.
New scheduled tasks, services, or persistence artifacts on hosts running Telerik Reporting.

Detection Strategies

Inspect web server and application logs for requests to Telerik Reporting service paths with atypical Content-Type values or oversized request bodies.
Baseline the process tree of the Telerik Reporting host and alert on any child process creation that deviates from that baseline.
Correlate authentication events with subsequent report generation activity to identify low-privilege accounts triggering code execution behaviors.

Monitoring Recommendations

Enable verbose logging on the Telerik Reporting service and forward logs to a centralized analytics platform for retention and query.
Monitor .NET deserialization exceptions and errors, which frequently indicate exploitation attempts against unsupported gadget chains.
Track file system writes by the reporting service process to detect webshell drops or staged binaries.

How to Mitigate CVE-2024-1856

Immediate Actions Required

Upgrade Telerik Reporting to version 2024 Q1 (18.0.24.130) or later as directed in the vendor advisory.
Inventory all applications embedding Telerik Reporting assemblies and update bundled dependencies to the fixed version.
Restrict network access to Telerik Reporting service endpoints so only trusted application tiers can reach them.
Rotate credentials and service account secrets used by the reporting host if compromise is suspected.

Patch Information

Progress released the fix in Telerik Reporting 2024 Q1 (18.0.24.130). Refer to the Progress knowledge base article for CVE-2024-1801 and CVE-2024-1856 for upgrade guidance and downloads. The Telerik Reporting product page lists supported releases.

Workarounds

Place the Telerik Reporting service behind an authenticated reverse proxy and restrict inbound traffic to known application servers.
Enforce least privilege on the service account running Telerik Reporting to limit post-exploitation impact.
Apply web application firewall rules that block requests containing serialized .NET type markers such as System.Runtime.Serialization payload signatures.

bash

# Configuration example: restrict Telerik Reporting service to internal application tier
# Example Windows Firewall rule blocking external access to the reporting port
New-NetFirewallRule -DisplayName "Block External Telerik Reporting" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 83 \
  -RemoteAddress Internet \
  -Action Block