Progress Telerik Report Server Authentication Bypass and Remote Code Execution Vulnerability (CVE-2024-4358) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTProgress Telerik Report Server 2024 Q1 (10.0.24.305) and earlier versions hosted on IIS
Unauthenticated remote attackers can bypass authentication mechanisms to gain administrative access, access restricted functionality, or potentially execute arbitrary code
Immediately upgrade Telerik Report Server to the latest secure version (2024 Q2 10.1.24.514 or later) and restrict IIS access to trusted IPs
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade Telerik Report Server to version 2024 Q2 (10.1.24.514) or later. Use the following PowerShell script to verify the currently installed version before performing the upgrade.
# Check the installed Telerik Report Server version from Web.config
$configPath = 'C:\Program Files (x86)\Progress\Telerik Report Server\Web.config'
if (Test-Path $configPath) {
[xml]$xml = Get-Content $configPath
$verNode = $xml.configuration.appSettings.add | Where-Object { $_.key -eq 'Version' }
Write-Host 'Detected Telerik Report Server Version:' $verNode.value
} else {
Write-Host 'Web.config not found. Please verify the installation path.'
}2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the Telerik Report Server IIS site using IP Address and Domain Restrictions to allow only trusted administrative networks.
# Enable IIS IP Security Feature
Install-WindowsFeature Web-IP-Security
# Configure IIS to deny unlisted IPs and allow only a specific admin subnet (e.g., 10.0.0.0/24)
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\sites\TelerikReportServer'
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.255.255.0';allowed='true'} -PSPath 'IIS:\sites\TelerikReportServer'3. Log Audit & IoC Verification Commands
Inspect IIS W3C logs for unauthorized access attempts to setup or registration endpoints, which may indicate exploitation attempts.
# Search IIS logs for suspicious POST requests to setup or registration endpoints
grep -iE '(/api/reportserver/setup|/Startup/)' /cygdrive/c/inetpub/logs/LogFiles/W3SVC1/*.log | grep -E ' (200|500) 'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-4358) is an authentication bypass flaw in Progress Telerik Report Server when hosted on IIS. The root cause lies in the improper validation of authentication states within the application's setup and registration endpoints (CWE-290). This allows an unauthenticated attacker to forge requests that bypass the standard authentication flow.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending crafted HTTP requests to specific endpoints, such as the initial setup or registration routes. Because the server fails to properly verify if an administrator account has already been configured or fails to validate session tokens, the attacker can register a new administrative user or hijack existing sessions. Once administrative access is obtained, the attacker can leverage built-in reporting features to upload malicious files (e.g., web shells) and execute arbitrary code on the host system.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation can lead to full system compromise, unauthorized access to sensitive corporate reports, data exfiltration, and potential lateral movement within the internal network.
Official Vendor Advisories & References
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Frequently Asked SecOps Questions (CVE-2024-4358)
FAQQ1. How critical is CVE-2024-4358 and is it actively exploited in the wild?
CVE-2024-4358 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-4358?
Primary impacted vendors include progress across telerik report server. Scope summary: Progress Telerik Report Server versions 2024 Q1 (10.0.24.305) and earlier on IIS
Q3. What temporary mitigations or workarounds exist for CVE-2024-4358 before patching?
[Mitigation] Immediately upgrade Telerik Report Server to the latest secure version (2024 Q2 10.1.24.514 or later) and restrict IIS access to trusted IPs Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-4358
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.