Addressing security vulnerabilities in ReportViewerWebControl.axd dependencies

Question

Hello Microsoft community,

We're using the ReportViewerWebControl.axd(Version=15.0.0.0) in our application and have identified potential security vulnerabilities in its dependencies, specifically outdated versions of jQuery and Knockout. Our security scan has flagged the following issues:

1. jQuery (versions 2.1.1 and 3.3.1):
   • Multiple CVEs including CVE-2015-9251, CVE-2019-11358, CVE-2020-11023, and CVE-2020-11022
   • End-of-life status for jQuery 1.x and 2.x
   Knockout (version 3.2.0):
   • CVE-2019-14862

As ReportViewerWebControl.axd is a Microsoft-controlled component, we cannot directly update these dependencies. We're seeking guidance on:

1. Is Microsoft aware of these vulnerabilities in the control?
2. Are there plans to update the dependencies in ReportViewerWebControl.axd?
3. Can you recommend any mitigation strategies we can implement without modifying the control itself?
4. Is there a way to override or replace the vulnerable scripts while still using the control?

Any insights or recommendations would be greatly appreciated. We're committed to maintaining the security of our application and would like to address these vulnerabilities as effectively as possible.

Thank you for your assistance.

Answer 1

You could try upgrading (nuget) to the latest edition. While the reference shows 15.0.0.0, if you look close at the reference for that viewer, you find this version:

So, I see 150.1652.0. And it looks to be using jQuery 3.6. So, consider updating the report viewer control, as it should be using at least jQuery 3.6. Can't comment on the other issues, but try updating the report viewer control.

Answer 2

As ReportViewerWebControl.axd is a Microsoft-controlled component, we cannot directly update these dependencies.

The ReportViewerWebControl.axd is only HTTP handler which is used to download external JavaScript files. See the following image which shows the html source of ReprtViwer page:

Since The ReportViewerWebControl.axd is only HTTP handler, I don't think that there is potential security vulnerabilities in the ReportViewerWebControl.axd itself.

As you can see the above html source, the ReportViewerWebControl.axd downloads the jquery.min.js and knockout.js.

Check the versions of the jquery.min.js and knockout.js in your environment. You will be able to see the source code of JavaScript files by clicking the ReportViewerWebControl.axd in the above html source as shown below:

The above is the results of the ReportViewer latest version 15.0.1652. I guess that your issue will be solved when you use the ReportViewer latest version 15.0.1652.

Answer 3

deleted because duplicated