Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
Telerik Report Server RCE Vulnerability: How Hackers Can Create Rogue Admins and Execute Code
Cybersecurity researcher Sina Kheirkhah has demonstrated a chained remote code execution vulnerability on Progress Telerik Report Servers, exploiting an authentication bypass and a deserialization issue. Organizations should urgently update to version 10.1.24.514 to prevent unauthorized admin account creation and arbitrary code execution.
Hot Take:
Looks like the bug hunters have struck gold again, with Progress Telerik Report Servers becoming the latest playground for cyber mischief. Just when you thought your reports were safe, boom! Here comes an RCE vulnerability to spice up your IT life!
Key Points:
- Researchers demonstrated a chained RCE vulnerability on Progress Telerik Report Servers.
- The exploit involves two main flaws: CVE-2024-4358 (authentication bypass) and CVE-2024-1800 (deserialization issue).
- Authentication bypass flaw allows creation of rogue admin accounts.
- Deserialization issue enables remote code execution via specially crafted XML payloads.
- Organizations must update to version 10.1.24.514 or later to patch these vulnerabilities.
Already a member? Log in here