CVE-2024-4200: 
Progress Telerik Reporting vulnerability analysis and mitigation

In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible through an insecure deserialization vulnerability. The vulnerability was discovered and disclosed in May 2024, affecting all versions of Telerik Reporting up to version 18.0.24.305 (Telerik Advisory, NVD).

The vulnerability is classified as CWE-502: Deserialization of Untrusted Data. It received a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H according to NVD's assessment, while the vendor assessed it with a score of 7.7 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The vulnerability specifically occurs when the Telerik Reporting engine deserializes untrusted localization assets (NVD, Telerik Advisory).

A successful exploitation of this vulnerability could allow local code execution when the Telerik Reporting engine processes untrusted localization assets. The vulnerability takes effect only when replacing one or more Telerik Reporting assets with a custom one containing malicious code (Telerik Advisory).

The vulnerability requires local access and user interaction to be exploited. It can be triggered by a local threat actor through an insecure deserialization vulnerability (NVD).

The only recommended mitigation is to update to Telerik Reporting version 2024 Q2 (18.1.24.2.514) or later. Users should never replace localization assets from sources of unknown origin. To verify the current version, users can either check the REST service endpoint /api/reports/version/ or examine PC Settings > Installed Apps > Telerik Reporting details (Telerik Advisory).