CVE-2024-4202: 
Progress Telerik Reporting vulnerability analysis and mitigation

A code execution vulnerability (CVE-2024-4202) was discovered in Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514). The vulnerability was disclosed on May 15, 2024, and affects all versions of Telerik Reporting before version 18.1.24.514 (Vendor Advisory).

The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). It has received a CVSS v3.1 base score of 8.6 (HIGH) from NIST and 7.7 (HIGH) from Progress Software Corporation. The vulnerability vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability allows local code execution when the Telerik Reporting engine loads a custom assembly as part of the communication workflow between desktop report viewers (WinForms, WPF, WinUI) and a remote Reporting engine. This can lead to potential code execution attacks through an insecure instantiation vulnerability (Vendor Advisory).

The vulnerability takes effect only when replacing one or more Telerik Reporting assemblies with custom assemblies containing malicious code. Users should never replace Telerik Reporting assemblies with assemblies obtained from sources with unknown origins (Vendor Advisory).

The only recommended mitigation is updating to Telerik Reporting version 2024 Q2 (18.1.24.514) or later. Users running version 18.0.24.305 or earlier should immediately update to version 18.1.24.514. The vulnerability has been addressed in this version, and the Progress Telerik team strongly recommends performing the upgrade (Vendor Advisory).