CVE-2024-1856: 
Progress Telerik Reporting vulnerability analysis and mitigation

CVE-2024-1856 affects Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130). The vulnerability allows remote threat actors to execute arbitrary code through an insecure deserialization vulnerability (NVD, Vendor Advisory).

The vulnerability exists within the ObjectReader class and stems from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H according to NVD, while the vendor assigned a score of 8.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (ZDI).

An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. The vulnerability affects confidentiality, integrity, and availability of the system with high severity ratings across all three aspects (ZDI).

The vulnerability requires authentication to exploit but can be triggered remotely. The attack complexity is considered low according to NVD's assessment, though the vendor rates it as high in their CVSS scoring (NVD, Vendor Advisory).

The only way to remediate this vulnerability is to update to Telerik Reporting version 2024 Q1 (18.0.24.305) or later. Progress Software has issued an update to correct this vulnerability (Vendor Advisory).

The vulnerability was responsibly disclosed by a researcher (identified as 07842c0e165d4d2d8733dd4eab48b3ed0f7afe38) working with Trend Micro Zero Day Initiative (Vendor Advisory).