# CVE-2024-4358: Progress Telerik Report Server - Authentication Bypass

> Live exploitation tracking for CVE-2024-4358 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-4358

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Progress Telerik Report Server
- **Weaknesses:** CWE-290 (Authentication Bypass by Spoofing)
- **Tags:** web_server, windows

## Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

## CrowdSec analysis

[CVE-2024-4358](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-4358) is a high-severity vulnerability in Progress Telerik Report Server that allows unauthenticated attackers to bypass authentication and gain access to restricted functionality when the software is deployed on IIS.

CrowdSec has been tracking this vulnerability and its exploits since 18th of June 2024.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-4358 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2024-4358 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploitation attempts often involve requests to endpoints such as `/startup/register` or `/report/index`.

## Timeline

- 2024-05-29: CVE Published. CVE-2024-4358 is published to NVD.
- 2024-06-13: CISA KEV. CVE-2024-4358 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-06-18: Rule Released. CrowdSec releases a rule to detect CVE-2024-4358 exploitation attempts against the CrowdSec Network.
- 2024-07-04: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-4358 for the first time.

## References

- https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-4358) follows observed exploitation activity for CVE-2024-4358. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.