DevExpress XtraReports Missing Protection of Serialized Data Vulnerability in ASP.NET Web Forms

A vulnerability exists in DevExpress versions prior to 23.1.3, as well as in several 22.x and 21.x releases, where the XtraReport serialized data is not adequately protected in ASP.NET Web Forms. This lack of proper protection can lead to unauthorized access or manipulation of the report data.

Impact

Exploitation of this vulnerability can result in unauthorized access to XtraReport serialized data, potentially allowing for manipulation or misuse of the report information.

Reproduction

The vulnerability can be reproduced by sending a well-formed request to a report control's backend, which will bypass the default data source protection and allow untrusted access to the serialized data.

Remediation

Users are advised to update to DevExpress version 23.1.3 or later.