Authentication Bypass Vulnerability in Progress Telerik Report Server

What changed

A significant vulnerability has been discovered in Progress Telerik Report Server, specifically in version 2024 Q1 (10.0.24.305) and earlier. This flaw allows unauthenticated attackers to bypass authentication mechanisms, granting them access to restricted functionalities of the server.

This vulnerability is particularly concerning as it can be exploited without requiring any valid credentials, potentially leading to unauthorized data access and manipulation.

Who is affected

Organizations utilizing Progress Telerik Report Server, especially those running the affected versions on IIS, are at risk.

This vulnerability impacts users across various sectors that rely on Telerik for reporting solutions.

• Progress Telerik Report Server (version 2024 Q1 and earlier)
• Organizations deploying Telerik solutions on IIS
• Developers and IT administrators managing Telerik Report Server instances

What to do

It is crucial for affected organizations to assess their current deployment of Progress Telerik Report Server and apply necessary updates to mitigate the risk associated with this vulnerability.

Implementing additional security measures, such as network segmentation and monitoring for unusual access patterns, can also help protect against potential exploitation.

• Upgrade to the latest version of Progress Telerik Report Server to patch the vulnerability.
• Review access controls and authentication mechanisms to ensure they are robust.
• Monitor server logs for any unauthorized access attempts.