Loading vulnerability…
CVE-2020-0618 is a remote code execution vulnerability in Microsoft SQL Server Reporting Services (SSRS). The flaw is caused by unsafe deserialization of user-controlled data in the SSRS web application, specifically in ReportingServicesWebServer.dll where the Microsoft.Reporting.WebForms.BrowserNavigationCorrector OnLoad method processes attacker-supplied state using LosFormatter without adequate integrity protection. An authenticated low-privileged user, including a user assigned only the Browser role, can reach the vulnerable functionality through the SSRS report viewing workflow and submit crafted page state data that triggers deserialization of a malicious object graph. Successful exploitation results in arbitrary code execution on the SSRS server in the security context of the Report Server service account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a single Metasploit module (Ruby) that exploits CVE-2020-0618, a ViewState deserialization vulnerability in Microsoft SQL Server Reporting Services (SSRS). The module targets Windows platforms and leverages the lack of ViewState signing to achieve remote code execution. It authenticates to the SSRS web application using provided Windows credentials, verifies the presence of SSRS via its API, discovers the virtual directory, and then sends a maliciously crafted ViewState object to the ReportViewer.aspx endpoint. The payload can be a direct command or a staged dropper, allowing for flexible post-exploitation. The module is weaponized, supporting multiple payload types and architectures, and is part of the Metasploit framework. The main attack vector is network-based, targeting HTTP(S) endpoints exposed by SSRS. The code is well-structured, with clear separation of detection, exploitation, and payload delivery logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A long-patched remote code execution vulnerability in Microsoft SQL Server that attackers used to compromise externally exposed, unpatched SQL servers.
A remote code execution vulnerability in Microsoft SQL Server Reporting Services (SSRS) caused by unsafe deserialization via LosFormatter in ReportingServicesWebServer.dll. Low-privileged authenticated users with the Browser role could execute code on the server.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.