CVE-2017-11357
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Description
CVE-2017-11357 is a critical arbitrary file upload and remote code execution vulnerability in Progress Telerik UI for ASP.NET AJAX, affecting versions prior to R2 2017 SP2. The flaw exists in the RadAsyncUpload component, which does not properly restrict user input, allowing unauthenticated remote attackers to upload arbitrary files to the web server or execute arbitrary code. With a CVSS v3.1 score of 9.8 and an EPSS score of 93.8% (99.86th percentile), this vulnerability poses a severe risk to any web application using the affected Telerik UI component. CISA has added CVE-2017-11357 to the Known Exploited Vulnerabilities catalog and confirmed it as a known ransomware attack vector, requiring immediate remediation for all affected installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | telerik ui for asp.net ajax | < 2020.1.114 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference(Mitigation, Vendor Advisory)
- https://www.exploit-db.com/exploits/43874/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2017-11357 is classified under CWE-434, which describes a weakness where software allows the upload of files with dangerous types without adequate restrictions. In the RadAsyncUpload component of Telerik UI for ASP.NET AJAX, the file upload handler does not properly validate or restrict the types and content of uploaded files, nor does it adequately control user input to the upload mechanism. This allows attackers to upload executable files such as web shells to the server, which can then be accessed to execute arbitrary code with the privileges of the web application.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2017-11357 carries a CVSS v3.1 score of 9.8 (Critical severity), reflecting maximum or near-maximum risk across all assessment metrics. Attack Vector (Network): The vulnerability is remotely exploitable over HTTP, targeting any web application that includes the Telerik UI RadAsyncUpload component. Attack Complexity (Low): No special conditions, race conditions, or preparation are needed for successful exploitation. Privileges Required (None): The attack requires no authentication, meaning any network-connected attacker can exploit the flaw. User Interaction (None): Exploitation is fully automated and requires no action from legitimate users or administrators. Scope (Unchanged): The impact is contained within the web application hosting the Telerik UI component. Confidentiality Impact (High), Integrity Impact (High), and Availability Impact (High) indicate complete compromise of the web application and potentially the underlying server, as arbitrary file upload and code execution grant full control over the application's data, configuration, and operation. The EPSS score of 93.8% (99.86th percentile) places CVE-2017-11357 among the most actively exploited vulnerabilities. CISA has confirmed this as a known ransomware attack vector, indicating that threat actors have used this Telerik UI vulnerability as an entry point for ransomware deployments against web applications built with ASP.NET.
Exploit Maturity
Public exploit code is available for CVE-2017-11357 via Exploit-DB, providing a ready-to-use proof-of-concept for arbitrary file upload and remote code execution against vulnerable Telerik UI installations. Progress has published vendor advisory guidance documenting the insecure direct object reference in RadAsyncUpload. CISA added CVE-2017-11357 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 16, 2023, confirming active exploitation in the wild despite the vulnerability being disclosed in 2017. CVE-2017-11357 is a confirmed ransomware attack vector, demonstrating that legacy web application vulnerabilities in widely-deployed UI frameworks remain highly valuable to threat actors years after initial disclosure. The EPSS score of 93.8% (99.86th percentile) reflects sustained exploitation activity, driven by the large installed base of Telerik UI for ASP.NET AJAX applications and the difficulty many organizations face in identifying and updating embedded third-party UI components.
Remediation
- Upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later immediately to address the RadAsyncUpload vulnerability. This is required by CISA's KEV catalog directive, which mandates applying vendor mitigations or discontinuing use of the product if mitigations are unavailable.
- Identify all applications using Telerik UI for ASP.NET AJAX across your environment, including legacy and internally-developed applications. The Telerik UI components are often embedded in custom web applications, making it difficult to track all affected installations through standard software inventory tools alone.
- Implement web application firewall (WAF) rules to detect and block malicious file upload attempts targeting the RadAsyncUpload handler. Configure rules to inspect file content and restrict dangerous file types such as ASPX, ASP, and other executable file extensions from being uploaded through the Telerik handler.
- Audit web servers for indicators of compromise including unauthorized web shells, unexpected ASPX or ASP files in upload directories, anomalous outbound network connections from web servers, and evidence of post-exploitation activity such as privilege escalation or lateral movement.
- Review and harden RadAsyncUpload configuration by following Progress Telerik's security best practices, including configuring encryption keys, restricting allowed file extensions, setting maximum file sizes, and ensuring the upload handler is properly secured even after patching to provide defense in depth.
Technical Details
CVE-2017-11357 targets the RadAsyncUpload component of Progress Telerik UI for ASP.NET AJAX, a widely-used UI framework for building web applications on the Microsoft ASP.NET platform. The RadAsyncUpload component provides asynchronous file upload functionality and is commonly embedded in web forms across enterprise applications. The vulnerability exists because the component does not properly restrict or validate user input, specifically failing to enforce adequate controls on what files can be uploaded and how the upload mechanism can be invoked. An unauthenticated attacker can manipulate the RadAsyncUpload handler to bypass intended restrictions and upload arbitrary files, including executable web shells (such as ASPX files), to the web server. Once a web shell is uploaded, the attacker can access it through the web server to execute arbitrary commands with the privileges of the IIS application pool identity. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the critical nature of this flaw: unauthenticated network-based exploitation with full impact on confidentiality, integrity, and availability. The affected versions are all releases of Telerik UI for ASP.NET AJAX prior to R2 2017 SP2, spanning a significant portion of the product's deployment history and affecting many legacy applications that may not receive regular updates.
Frequently Asked Questions
Is CVE-2017-11357 being actively exploited?
Yes, CVE-2017-11357 is actively exploited in the wild despite being disclosed in 2017. CISA added it to the Known Exploited Vulnerabilities catalog in 2023 with a remediation deadline of February 16, 2023, and confirmed it as a ransomware attack vector. Public exploit code is available on Exploit-DB, and the EPSS score of 93.8% (99.86th percentile) reflects sustained exploitation activity.
What products are affected by CVE-2017-11357?
CVE-2017-11357 affects Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2. The vulnerability is specifically in the RadAsyncUpload component, which is embedded in many custom ASP.NET web applications. Any web application using an unpatched version of this Telerik UI component is at risk.
How do I fix CVE-2017-11357?
Upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later. Since Telerik UI components are often embedded in custom applications, you may need to rebuild and redeploy affected applications after updating the component library. If immediate patching is not possible, implement WAF rules to block malicious file uploads to the RadAsyncUpload handler.
How severe is CVE-2017-11357?
CVE-2017-11357 has a CVSS v3.1 score of 9.8 (Critical severity), enabling unauthenticated remote code execution through arbitrary file upload. It is confirmed as a ransomware attack vector and continues to be actively exploited years after disclosure due to the large installed base of legacy Telerik UI applications. The EPSS score of 93.8% (99.86th percentile) reflects extremely high exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.