---
title: "Telerik Report Server CVE-2024-4358: Admin Auth Bypass"
url: https://erroneo.us/security/briefs/telerik-report-server-cve-2024-4358-auth-bypass/
description: "Unauthenticated admin creation in Telerik Report Server before 10.1.24.514, chained to RCE and exploited in 2024. Upgrade, then audit the user list."
type: security-brief
section: "Security Digest"
date_published: 2024-05-15
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-4358"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Telerik Report Server CVE-2024-4358: Admin Auth Bypass

**Verdict: Check exposure.** Fixed in May 2024 and attacked within days of a public exploit chain; few servers are exposed, but any that ran an old build online should be upgraded to a current release and checked for administrator accounts nobody created.

- **Who must act:** Owners of self-hosted Telerik Report Server on IIS running a build older than 2024 Q2 (10.1.24.514), and anyone whose Report Server was reachable from the internet in mid-2024.
- **Who can relax:** Teams that do not run Telerik Report Server; users of other Telerik products are not affected by this specific bug, though they have their own advisories.
- **Affected:** Telerik Report Server 2024 Q1 (10.0.24.305) and earlier, on IIS
- **Fixed:** Telerik Report Server 2024 Q2 (10.1.24.514), May 15, 2024; Now: 2024 Q2 (10.1.24.709) or later for CVE-2024-6327; current release is 2026 Q3 (12.2.26.1007)
- **CVEs:** CVE-2024-4358
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Telerik Report Server instance and record its version.
2. Upgrade to the current release, 2026 Q3 (12.2.26.1007), or at minimum 10.1.24.709, which also fixes the later deserialization bug CVE-2024-6327.
3. If you cannot upgrade at once, add the vendor's IIS URL Rewrite request-blocking rule for the path startup/register.
4. Remove direct internet exposure; publish Report Server only to users who need it, through a VPN or IP allowlist.
5. Review the user list at {host}/Users/Index, delete local users you did not create, and rotate administrator passwords.

### How to check if you are affected

- Compare the Report Server user list at /Users/Index with your records; look hardest at local users with the System Administrator role.
- Search IIS logs for requests to startup/register made after the server's initial setup date.
- Look for report uploads (.trdp or .trbp) that nobody on your team made, and for cmd.exe or powershell.exe started by the Report Server's IIS worker process.

## What happened

On May 15, 2024, Progress released Telerik Report Server 2024 Q2 (10.1.24.514), according to its [Critical Alert](https://www.telerik.com/report-server/documentation/knowledge-base/registration-auth-bypass-cve-2024-4358) and [release history](https://www.telerik.com/support/whats-new/report-server/release-history). The release fixes CVE-2024-4358, an authentication bypass by spoofing (CWE-290). An unauthenticated attacker can reach restricted Report Server functions on IIS. Progress scores it CVSS 3.1 9.8 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-4358), published May 29, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-4358) agrees.

The finder, Sina Kheirkhah of Summoning Team, reported through Trend Micro's Zero Day Initiative. His [write-up](https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/) shows the cause. The first-run setup method, `StartupController.Register`, stays reachable without login after setup is finished. It creates a user and gives that user the System Administrator role. He chained it with [CVE-2024-1800](https://www.cve.org/CVERecord?id=CVE-2024-1800), a deserialization flaw in uploaded report packages. Progress rates that flaw 9.9 and says in its [KB](https://www.telerik.com/report-server/documentation/knowledge-base/deserialization-vulnerability-cve-2024-1800) that 10.0.24.305 fixes it. The chain gives code execution with no credentials. He published it with a proof of concept in early June.

Attacks followed within days. [TechTarget](https://www.techtarget.com/searchsecurity/news/366588012/Critical-Progress-Telerik-vulnerability-under-attack) reported that the Shadowserver Foundation saw exploitation attempts in its honeypots from June 5. Its scans that day found 95 exposed servers, 89 of them on vulnerable versions. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358) on June 13, 2024, with a July 4 deadline. Ransomware use is listed as unknown.

## Who is affected

Telerik Report Server 2024 Q1 (10.0.24.305) and earlier on IIS. Other Telerik products, such as Telerik Reporting or UI for ASP.NET AJAX, are separate products with their own advisories.

## Do you really need to act?

Few organizations run Report Server on the internet, so this is a check-exposure item, not an emergency. Two points matter for anyone who does. First, 10.1.24.514 is not a safe stopping point. [CVE-2024-6327](https://www.cve.org/CVERecord?id=CVE-2024-6327), another deserialization RCE rated 9.9, was fixed in 10.1.24.709 in July 2024. The current release is 2026 Q3 (12.2.26.1007), from October 7, 2026. Second, an administrator account created through the bypass survives an upgrade. Progress says upgrading is the only way to remove the bug. It also asks customers to review the user list for local users they did not add.

## What to do now

1. Find each instance and its version, for example with `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Report Server*' | Select DisplayName, DisplayVersion`.
2. Upgrade to the current release, or at least 10.1.24.709.
3. If you must wait, add the vendor's IIS URL Rewrite rule that blocks the URL path `startup/register`. Add it only after setup is finished.
4. Take the server off the open internet.
5. Review `{host}/Users/Index`, remove unknown users and rotate admin passwords.

## How to tell if you were hit

- Check for local users with the System Administrator role that nobody on your team created.
- Search IIS logs for the path, for example `Select-String -Path C:\inetpub\logs\LogFiles\W3SVC*\*.log -Pattern 'startup/register'`. Hits after your setup date need an explanation.
- Look for `.trdp` or `.trbp` report uploads you cannot explain. Also look for `cmd.exe` or `powershell.exe` launched by the Report Server's IIS worker process.

## Timeline

- Mar 6, 2024 — Report Server 10.0.24.305 is released; Progress names it as the fix for CVE-2024-1800.
- May 15, 2024 — Report Server 2024 Q2 (10.1.24.514) is released.
- May 29, 2024 — CVE-2024-4358 is published.
- Jun 5, 2024 — Shadowserver sees exploitation attempts.
- Jun 13, 2024 — CISA adds CVE-2024-4358 to KEV.
- Jul 24, 2024 — CVE-2024-6327 is published; fixed in 10.1.24.709.

## Sources

1. [Progress Telerik — Critical Alert, May 2024: CVE-2024-4358](https://www.telerik.com/report-server/documentation/knowledge-base/registration-auth-bypass-cve-2024-4358)
2. [Progress Telerik — CVE-2024-1800 Deserialization Vulnerability](https://www.telerik.com/report-server/documentation/knowledge-base/deserialization-vulnerability-cve-2024-1800)
3. [Progress Telerik — Report Server release history](https://www.telerik.com/support/whats-new/report-server/release-history)
4. [CVE record — CVE-2024-4358](https://www.cve.org/CVERecord?id=CVE-2024-4358)
5. [NVD — CVE-2024-4358](https://nvd.nist.gov/vuln/detail/CVE-2024-4358)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-4358](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358)
7. [Summoning Team (Sina Kheirkhah) — Telerik Report Server write-up and PoC for CVE-2024-4358 and CVE-2024-1800](https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/)
8. [CVE record — CVE-2024-1800](https://www.cve.org/CVERecord?id=CVE-2024-1800)
9. [CVE record — CVE-2024-6327](https://www.cve.org/CVERecord?id=CVE-2024-6327)
10. [TechTarget — Critical Progress Telerik vulnerability under attack](https://www.techtarget.com/searchsecurity/news/366588012/Critical-Progress-Telerik-vulnerability-under-attack)

---
Source page: https://erroneo.us/security/briefs/telerik-report-server-cve-2024-4358-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt