Description
Progress Telerik Report Server存在不安全的反序列化漏洞。该漏洞是由于接口 report 对需要反序列化的数据没有经过充分验证导致的。
Progress Telerik Report Server CVE-2024-1800 不安全的反序列化漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.tenablecloud.cn/plugins/nessus/200090
https://www.anquanke.com/post/id/297127
https://avd.aliyun.com/detail?id=AVD-2024-1800
https://www.venustech.com.cn/new_type/aqtg/20240605/27616.html
https://rivers.chaitin.cn/blog/cqi83vp0lnedo7thpq50
https://cn-sec.com/archives/2820032.html
https://buaq.net/go-252665.html
https://www.telerik.com/report-server/documentation/knowledge-base/deserialization-vulnerability-cve-2024-1800
https://github.com/sinsinology/CVE-2024-4358
https://www.sentinelone.com/vulnerability-database/cve-2024-1800/
https://www.broadcom.com/support/security-center/protection-bulletin/cve-2024-4358-cve-2024-1800-vulnerabilities-in-telerik-report-server
https://www.cve.org/CVERecord?id=CVE-2024-1800
https://arcticwolf.com/resources/blog/cve-2024-4358-cve-2024-1800/
https://csirt.divd.nl/cases/DIVD-2024-00023/
https://www.tenable.com/plugins/was/114294
https://www2.gov.bc.ca/assets/gov/british-columbians-our-governments/services-policies-for-government/information-management-technology/information-security/vulnerability-risk-management/vulnerability-reports/n24-255_progress_telerik_security_advisory.pdf
https://censys.com/advisory/march-26-2024-progress-telerik-report-server-rce-cve-2024-1800/
https://www.zerodayinitiative.com/advisories/ZDI-24-403/
https://www.savetime.com.tw/Symantec-Protection-Bulletin-Weekly.asp
https://metc.njtc.edu.cn/info/1141/4822.htm
https://nic.seu.edu.cn/info/1047/1240.htm
https://feedly.com/cve/CVE-2024-1800
https://www.securityweek.com/progress-patches-critical-vulnerability-in-telerik-report-server/
https://hivepro.com/threat-advisory/chained-flaws-in-progress-telerik-report-server-enable-unauthenticated-rce/
https://www.theregister.com/security/2024/07/26/critical-bug-in-progress-telerik-report-server-leads-to-rce/511188
https://thehackernews.com/2024/06/telerik-report-server-flaw-could-let.html