Elevação de Privilégios via Instalador do Telerik Reporting

The primary impact of CVE-2024-0832 is the potential for privilege escalation. An attacker, already possessing limited access to a system with Telerik Reporting installed, can exploit this vulnerability to gain administrative or system-level privileges. This could allow them to install malicious software, modify system configurations, steal sensitive data, or compromise the entire system. The ability to manipulate the installation package represents a significant attack vector, as it bypasses typical security controls designed to prevent unauthorized privilege elevation. This vulnerability is particularly concerning in environments where user access controls are not strictly enforced or where the installation process is not adequately secured.

Organizations using Telerik Reporting in environments where user access controls are not strictly enforced are at higher risk. This includes environments with shared hosting configurations or legacy systems with less stringent security practices. Specifically, systems where users have write access to the Telerik Reporting installation directory are particularly vulnerable.

• windows / dotnet:

Get-Process | Where-Object {$_.ProcessName -like '*TelerikReporting*'}

• windows / dotnet: Check registry for unusual entries related to Telerik Reporting installation paths. • windows / dotnet: Monitor event logs for suspicious processes attempting to modify installation files. • dotnet: Review application configuration files for any unexpected or unauthorized modifications. • generic web: Monitor web server access logs for unusual requests targeting the Telerik Reporting installation directory.

1. 2024-01-31Disclosure

   disclosure

1. Reservado2024-01-23
2. Publicada2024-01-31
3. Modificada2024-08-23
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-0832 is to upgrade Telerik Reporting to version 2024 R1 or later, which contains the fix. If an immediate upgrade is not feasible, consider restricting user access to the installation directory and disabling the ability to modify the installation package. Implement strict user access controls and regularly review user permissions. Monitor system logs for any suspicious activity related to the installation process. While a WAF or proxy cannot directly mitigate this vulnerability, they can help detect and block malicious attempts to manipulate the installation package.