CVE-2020-0618

What is SQL Server Reporting Services?

SQL Server Reporting Services (SSRS) is Microsoft's on-premises reporting platform, used to design, deploy, and manage business reports drawing on SQL Server data. Because SSRS is often reachable by a broad set of business users across an organization (anyone who needs to view or run a report), it has a comparatively wide authenticated attack surface relative to more tightly restricted database administration tools.

Overview

CVE-2020-0618 is a deserialization vulnerability (CWE-502) in SQL Server Reporting Services, arising from improper handling of page requests. An authenticated attacker can exploit it to execute code in the context of the Report Server service account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) — a comparatively low bar for authentication given SSRS's typically broad internal user base.

Technical Details

SSRS processes certain page requests by deserializing data associated with the request, and insufficient validation of that data before deserialization allows a crafted request to trigger execution of attacker-controlled code rather than being safely deserialized into the expected report-rendering objects. Because SSRS often has database credentials and connections configured for its reporting data sources, a compromised Report Server can expose or manipulate significant amounts of business data beyond the report content itself.

Discovery

Patched as part of Microsoft's routine February 2020 Patch Tuesday release.

Exploitation Context

CISA added this CVE to KEV in September 2024 — more than four years after original disclosure — indicating exploitation of long-unpatched, internet-facing or internally-exposed SSRS deployments continued to occur years after the fix was available, a pattern seen with other internal-facing enterprise reporting and business intelligence tools that don't receive the same patching urgency as directly internet-facing systems.

Remediation

1. Apply Microsoft's February 2020 Patch Tuesday update for SQL Server Reporting Services immediately if not already installed.
2. Restrict SSRS access to only the users and networks that need it, and avoid exposing the Report Server directly to the internet.
3. Review SSRS-configured data source credentials for any signs of misuse if the server was unpatched for an extended period.
4. Include reporting and business intelligence platforms in the same patch-priority tier as directly internet-facing systems — this CVE's four-year gap between patch and KEV addition suggests these tools are frequently deprioritized despite holding sensitive data access.