CVE-2024-4358 Scanner

Progress Telerik Report Server is a robust report management platform used by enterprises to design, store, and distribute reports. It is commonly deployed on IIS and integrates with SQL Server, Oracle, and other data sources. IT administrators and business analysts rely on it for scheduling, user permissions, and report customization. The software includes role-based access controls to protect sensitive data.

CVE-2024-4358 is a critical authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized administrative access. The flaw arises from improper validation of authentication tokens during the login process. This enables remote exploitation without any prior credentials or user interaction.

The vulnerability specifically affects the authentication endpoint in Progress Telerik Report Server versions prior to 2024 Q2 (10.1.24.514). Attackers can craft malicious requests to bypass the login mechanism and directly access administrative functions, such as user management and report configuration.

If exploited, an attacker can gain full administrative control over the Report Server, leading to unauthorized access to sensitive reports, data exfiltration, and potential lateral movement within the network. The CVSS score of 9.8 highlights the severe risk of complete compromise.