CVE-2024-4357: 
Progress Telerik Reporting vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2024-4357) was identified in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) and earlier versions. The vulnerability stems from improper restriction of XML External Entity (XXE) references, which allows low-privilege attackers to read system files through XML External Entity Processing. The vulnerability was discovered by Sina Kheirkhah of Summoning Team working with Trend Micro Zero Day Initiative (Telerik Advisory, ZDI Advisory).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference) and has been assigned a CVSS v3.1 score of 6.5 (Medium) with the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The specific flaw exists within the implementation of ValidateMetadaUri method, where improper restriction of XML External Entity references allows a crafted document specifying a URI to cause the XML parser to access the URI and embed the contents back into the XML document for further processing (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information in the context of SYSTEM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed (ZDI Advisory).

The vulnerability requires low attack complexity and can be exploited remotely. Authentication is required, but the existing authentication mechanism can be bypassed. The attack requires network access to the vulnerable component (ZDI Advisory).

Progress Software has released version 2024 Q2 (10.1.24.514) which addresses this vulnerability. The updated version is built on .NET Framework 4.6.2 and is no longer vulnerable to this XXE flaw. Users are advised to update to this version or later (Telerik Advisory).