Privilege Elevation via Telerik JustDecompile Installer

An attacker exploiting this vulnerability could gain unauthorized access to sensitive data, modify system configurations, or execute arbitrary code with elevated privileges. This could lead to a complete compromise of the affected system. The ability to manipulate the installer provides a relatively straightforward attack vector, particularly in environments where JustDecompile is commonly installed. Successful exploitation could allow an attacker to bypass existing security controls and gain persistent access to the system.

Organizations using Telerik JustDecompile, particularly those with a large number of developers or systems where JustDecompile is frequently used, are at risk. Environments with weak access controls to installation packages or where users have excessive privileges are especially vulnerable.

• windows / supply-chain:

Get-Process -Name JustDecompile | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*JustDecompile*'}

• windows / supply-chain:

reg query "HKLM\SOFTWARE\Telerik\JustDecompile" /v InstallLocation

1. 2024-01-31Disclosure

   disclosure

1. Reserviert2024-01-03
2. Veröffentlicht2024-01-31
3. Geändert2025-05-29
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-0219 is to upgrade Telerik JustDecompile to version 2024 R1 or later. If an immediate upgrade is not feasible, consider restricting access to the installation package and monitoring for suspicious activity related to the installer process. Implement least privilege principles to limit the permissions of users who may interact with the JustDecompile installer. Review existing security policies to ensure they adequately address privilege escalation risks.