CVE-2017-11317
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
Description
CVE-2017-11317 is an unrestricted file upload vulnerability in Telerik UI for ASP.NET AJAX that allows remote attackers to upload and execute malicious files on affected web servers via the RadAsyncUpload component. The vulnerability stems from the use of hard-coded encryption keys that protect the upload handler, enabling attackers to bypass upload restrictions entirely. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to confirmed active exploitation. With an extremely high EPSS score of 97.3% (99.9th percentile), this is one of the most actively exploited web application vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| telerik | ui for asp.net ajax | <= 2016.3.1027; 2017.2.503; 2017.2.621 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload(Mitigation, Vendor Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006(Third Party Advisory)
- https://www.exploit-db.com/exploits/43874/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11317(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
This weakness occurs when an application allows users to upload files without properly validating the file type, content, or destination, potentially enabling the upload of executable code. In CVE-2017-11317, the RadAsyncUpload component uses weak cryptographic protections that can be bypassed, allowing arbitrary file uploads. For more details, see CWE-434.
Impact Analysis
Successful exploitation enables attackers to upload web shells or other malicious files to the web server, leading to remote code execution with the privileges of the web application process. This can result in complete server compromise, data exfiltration, lateral movement within the organization's network, and deployment of ransomware or other malware. Since Telerik UI is commonly used in enterprise ASP.NET applications, the vulnerability affects a broad range of web applications across government agencies and private organizations, making the business impact potentially severe and widespread.
Exploit Maturity
CVE-2017-11317 has been actively exploited since its disclosure and was added to CISA's KEV catalog on April 11, 2022. The EPSS score of 97.3% (99.9th percentile) reflects the widespread exploitation and readily available exploit tools. Multiple threat actors including APT groups have leveraged this vulnerability to compromise web servers. Public exploit code and automated scanning tools are widely available, making this vulnerability accessible to attackers of all skill levels.
Remediation
- Update Telerik UI for ASP.NET AJAX to version R2 2017 SP1 (2017.2.621) or later, which addresses the hard-coded encryption key issue, as required by CISA's KEV catalog.
- Verify that custom encryption keys have been configured for the RadAsyncUpload handler to replace the default hard-coded keys.
- Implement web application firewall (WAF) rules to detect and block malicious file upload attempts targeting the Telerik AsyncUpload handler.
- Audit web servers for indicators of compromise including unauthorized web shells, suspicious files in upload directories, and unexpected process execution.
- Apply the principle of least privilege to the web application process account to minimize the impact of potential exploitation.
Technical Details
The RadAsyncUpload component in Telerik UI for ASP.NET AJAX uses cryptographic protection to secure the file upload configuration. However, prior to the patched version, the component relied on hard-coded encryption keys that were identical across all installations. An attacker who knows these keys can forge the upload configuration parameters, bypassing file type restrictions and specifying arbitrary upload destinations on the server. This allows uploading executable files such as ASPX web shells to web-accessible directories. The attack requires only network access to the web application and can be performed without authentication, making it trivially exploitable at scale.
Frequently Asked Questions
What is CVE-2017-11317?
CVE-2017-11317 is an unrestricted file upload vulnerability in the RadAsyncUpload component of Telerik UI for ASP.NET AJAX. It allows attackers to upload arbitrary files including web shells to affected web servers due to hard-coded encryption keys used to protect the upload handler.
How can I determine if my application is affected?
Check if your web application uses Telerik UI for ASP.NET AJAX with a version prior to R2 2017 SP1 (2017.2.621). Look for the Telerik.Web.UI.dll assembly in your application's bin directory and check its version number.
Can this vulnerability be exploited without authentication?
Yes, the vulnerability can typically be exploited without authentication because the RadAsyncUpload handler is accessible to unauthenticated users by default. The only protection is the cryptographic configuration, which uses hard-coded keys in vulnerable versions.
What should I do if my server has already been compromised?
If exploitation is suspected, immediately isolate the affected server, conduct a thorough forensic investigation to identify all web shells and backdoors, review access logs for unauthorized activity, and rebuild the server from known-good backups after patching the vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.