Critical Progress Telerik vulnerability under attack

Exploit chain discovery

Kheirkhah detailed how he discovered the exploit chain in a blog post on Monday. He credited researcher Soroush Dalili, director of SecProject, for assistance in understanding the full scope of the .NET deserialization flaw. Kheirkhah explained that he observed a CVSS score discrepancy between Telerik's and ZDI's advisories for CVE-2024-1800.

Progress mistakenly assigned it a 9.9 CVSS score, while ZDI gave it an 8.8.

"After I noticed the mistake on their scoring, I thought, it would actually be very funny if I can manage to find a way to bypass the authentication and actually make the issue into a Critical CVSS 9.9, so that's what I did!" Kheirkhah wrote in the blog post.

While researching the vulnerabilities, he discovered insecure deserialization can occur because users can create all types of reports using the software. He was also able to create parameters that allowed an attacker to create a user first, then assign that user as a system administrator. Kheirkhah stressed that it would allow a remote unauthenticated attacker to log in as an administrator, granting privileged access.

"I've discovered this issue in 5 minutes after I finished setting up the software, The vulnerability is very simple, the endpoint which is responsible for setting up the server for the first time is accessible unauthenticated even after the admin has finished the setup process," the blog post read.

Kheirkhah added that it's not the first time he's observed this type of "simple" issue. For example, he cited vulnerabilities in ConnectWise's ScreenConnect remote access software that came under attack in February. Security vendor Huntress described exploitation of the ScreenConnect vulnerability as "trivial and embarrassingly easy."

It's critical for users to patch the exploit chain as both Progress and Telerik products were involved in significant attacks in 2023. Last May, the Clop ransomware gang exploited a flaw in Progress' MoveIt Transfer file transfer product that affected a substantial number of downstream customer organizations, including U.S. government agencies.

Last year, CISA issued an advisory on how threat actors exploited a three-year-old .NET deserialization vulnerability, tracked as CVE-2019-18935, in Progress' Telerik UI. Advanced persistent threat actors exploited the vulnerability against a Federal Civilian Executive Branch agency that remained vulnerable.

Progress did not respond to request for comment at press time.

Arielle Waldman is a news writer for TechTarget Editorial covering enterprise security.