CVE-2024-1801: 
Progress Telerik Reporting vulnerability analysis and mitigation

CVE-2024-1801 affects Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130). The vulnerability was discovered on February 14, 2024, and publicly disclosed on April 25, 2024. This security issue involves an insecure deserialization vulnerability that could allow code execution attacks (Telerik KB, ZDI Advisory).

The vulnerability exists within the ObjectReader class and results from the lack of proper validation of user-supplied data, which can lead to deserialization of untrusted data. The issue has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a high severity level (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. The attack requires user interaction, specifically that the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires local access and user interaction to be exploited. A code execution attack is possible by a local threat actor through the insecure deserialization vulnerability (Telerik KB).

Progress Software has issued an update to address this vulnerability. The only way to remove this vulnerability is by updating to at least version Reporting 2024 Q1 (18.0.24.305). Users are strongly advised to upgrade their installations to the latest version (Telerik KB).

The vulnerability was responsibly disclosed by a researcher (identified as 07842c0e165d4d2d8733dd4eab48b3ed0f7afe38) working with Trend Micro Zero Day Initiative, who cooperated with Progress Software to address the security issue (Telerik KB).