CVE-2024-6096: Progress Telerik Reporting RCE Vulnerability

CVE-2024-6096 Overview

CVE-2024-6096 is a critical insecure deserialization vulnerability affecting Progress® Telerik® Reporting versions prior to 18.1.24.709. The vulnerability exists due to an insecure type resolution mechanism that allows attackers to execute arbitrary code through object injection. This unsafe reflection vulnerability enables remote attackers to craft malicious serialized objects that, when processed by the application, result in arbitrary code execution on the target system.

Critical Impact
Unauthenticated attackers can achieve remote code execution through object injection via insecure type resolution, potentially leading to complete system compromise with full confidentiality, integrity, and availability impact.

Affected Products

Progress Telerik Reporting versions prior to 18.1.24.709

Discovery Timeline

2024-07-24 - CVE-2024-6096 published to NVD
2025-04-25 - Last updated in NVD database

Technical Details for CVE-2024-6096

Vulnerability Analysis

This vulnerability is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')). The flaw exists in how Telerik Reporting handles type resolution during deserialization operations. When processing user-supplied input, the application fails to properly validate or restrict the types that can be instantiated through reflection mechanisms.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous in enterprise environments where Telerik Reporting is exposed to network traffic. An attacker can exploit this vulnerability by sending specially crafted requests containing malicious serialized payloads that specify arbitrary types for instantiation.

Root Cause

The root cause of CVE-2024-6096 lies in the unsafe handling of type information during deserialization operations. The Telerik Reporting component uses reflection to instantiate objects based on type information provided in serialized data without proper validation. This allows attackers to specify malicious types that execute arbitrary code upon instantiation.

The vulnerable code path fails to implement a secure type allowlist or blocklist, permitting the instantiation of dangerous types that can be leveraged for code execution. This is a common pattern in .NET deserialization vulnerabilities where gadget chains can be constructed to achieve arbitrary command execution.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker would typically:

Identify an endpoint that processes serialized data through Telerik Reporting
Craft a malicious serialized payload containing type references to dangerous .NET classes
Submit the payload to the vulnerable endpoint
The application deserializes the payload using unsafe reflection, instantiating the attacker-controlled types
The malicious type's constructor or methods execute arbitrary code on the server

The vulnerability allows object injection via insecure type resolution, which is a well-known attack pattern against .NET applications. Attackers can leverage existing gadget chains in the .NET framework or third-party libraries to construct payloads that achieve remote code execution. For detailed technical information, refer to the Telerik Knowledge Base article.

Detection Methods for CVE-2024-6096

Indicators of Compromise

Unusual or malformed requests containing serialized .NET objects sent to Telerik Reporting endpoints
Unexpected process spawning from the web application or IIS worker processes
Anomalous network connections initiated from the server hosting Telerik Reporting
Evidence of command execution or PowerShell activity originating from the reporting service

Detection Strategies

Monitor HTTP traffic for requests containing suspicious serialized object patterns targeting Telerik Reporting components
Implement application-level logging to capture deserialization events and type resolution activities
Deploy endpoint detection and response (EDR) solutions to identify post-exploitation behaviors such as process injection or credential access
Utilize web application firewalls (WAF) with rules to detect common .NET deserialization attack patterns

Monitoring Recommendations

Enable verbose logging on Telerik Reporting endpoints to capture request payloads and processing details
Monitor for unusual child processes spawned by the web server hosting Telerik Reporting
Set up alerts for outbound connections from the reporting server to unexpected destinations
Implement file integrity monitoring on the Telerik Reporting installation directory

How to Mitigate CVE-2024-6096

Immediate Actions Required

Upgrade Progress Telerik Reporting to version 18.1.24.709 or later immediately
If immediate patching is not possible, consider temporarily disabling or restricting network access to Telerik Reporting endpoints
Review application logs for any indicators of exploitation attempts
Implement network segmentation to limit exposure of Telerik Reporting services

Patch Information

Progress has released version 18.1.24.709 of Telerik Reporting which addresses this vulnerability. Organizations should upgrade to this version or later as soon as possible. The official vendor advisory and remediation guidance is available at the Telerik Knowledge Base. Additional security information is available in the NetApp Security Advisory.

Workarounds

Restrict network access to Telerik Reporting endpoints using firewall rules or network ACLs to trusted IP addresses only
Implement a web application firewall (WAF) with rules to block requests containing suspicious serialized object patterns
Enable authentication requirements on all Telerik Reporting endpoints if not already enforced
Consider placing Telerik Reporting behind a reverse proxy with request inspection capabilities

bash

# Example: Restrict access to Telerik Reporting endpoints via IIS URL Rewrite
# Add to web.config to block direct access from untrusted networks
# Note: Replace with your specific endpoint paths and trusted IP ranges

# Windows Firewall rule to restrict access (PowerShell)
New-NetFirewallRule -DisplayName "Restrict Telerik Reporting" -Direction Inbound -LocalPort 80,443 -Protocol TCP -RemoteAddress "10.0.0.0/8" -Action Allow