CVE-2017-9248
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Description
CVE-2017-9248 is a critical-severity cryptographic weakness vulnerability in Progress Telerik UI for ASP.NET AJAX and Sitefinity. The Telerik.Web.UI.dll component does not properly protect the DialogParametersEncryptionKey or the MachineKey, making it easier for remote attackers to defeat cryptographic protection mechanisms. Successful exploitation can lead to MachineKey disclosure, arbitrary file uploads and downloads, cross-site scripting (XSS), or ASP.NET ViewState compromise. CISA has added CVE-2017-9248 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 87.8% (99.5th percentile) indicates near-certain exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | sitefinity | < 10.0.6412.0 |
| telerik | ui for asp.net ajax | <= 2017.2.503 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/99965(Broken Link, Third Party Advisory, VDB Entry)
- http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity(Vendor Advisory)
- http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness(Mitigation, Vendor Advisory)
- https://www.exploit-db.com/exploits/43873/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248(US Government Resource)
Weakness Type
CWE-522: Insufficiently Protected Credentials
Insufficiently Protected Credentials occurs when a product transmits or stores authentication credentials using methods that do not adequately prevent unauthorized interception or access. In the case of CVE-2017-9248, Telerik UI for ASP.NET AJAX fails to adequately protect encryption keys within the Telerik.Web.UI.dll component, allowing attackers to recover the DialogParametersEncryptionKey or MachineKey through cryptographic weaknesses.
Learn more: CWE-522 — Insufficiently Protected Credentials
Impact Analysis
CVE-2017-9248 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting its severe threat level. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any remote attacker. Confidentiality (High): Attackers can disclose encryption keys and sensitive application data. Integrity (High): Arbitrary file uploads and ASP.NET ViewState tampering allow unauthorized modification of application logic and data. Availability (High): Full system compromise is possible through unrestricted file manipulation. With an EPSS score of 87.8% (99.5th percentile), exploitation is virtually certain, and organizations running vulnerable Telerik UI or Sitefinity deployments should treat this as an active, imminent threat.
Exploit Maturity
CVE-2017-9248 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2017-9248 via Exploit Database, significantly lowering the barrier for attackers. The EPSS score of 87.8% (99.5th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most likely to be exploited across all known CVEs. Federal agencies were required to remediate by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP1 or later, and Sitefinity to version 10.0.6412.0 or later.
- Rotate encryption keys: After patching, regenerate the Telerik.Web.UI.DialogParametersEncryptionKey and the ASP.NET MachineKey, as these may have been compromised prior to the update.
- Restrict access to Telerik dialog handlers: Use web application firewall (WAF) rules to block or restrict access to Telerik HTTP handler endpoints (e.g., Telerik.Web.UI.DialogHandler.aspx) from untrusted networks.
- Monitor for indicators of compromise: Review web server logs for suspicious requests targeting Telerik endpoints, unexpected file uploads, or unauthorized ViewState manipulation attempts.
- Implement defense-in-depth for credential storage: Ensure all encryption keys and MachineKeys are stored securely, rotated regularly, and never hardcoded or shared across environments.
Technical Details
CVE-2017-9248 exploits a cryptographic weakness in the Telerik.Web.UI.dll library used by both Progress Telerik UI for ASP.NET AJAX (before R2 2017 SP1) and Sitefinity (before 10.0.6412.0). The vulnerability stems from insufficient protection of the DialogParametersEncryptionKey and the ASP.NET MachineKey, allowing remote attackers to recover these secrets through cryptanalysis. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires no privileges or user interaction, and has low complexity. Once the encryption keys are obtained, an attacker can forge valid ViewState tokens, upload arbitrary files to the web server, download sensitive application files, or inject cross-site scripting payloads, effectively achieving full control over the affected web application.
Frequently Asked Questions
Is CVE-2017-9248 being actively exploited?
Yes. CVE-2017-9248 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 87.8% (99.5th percentile) places it among the most exploited vulnerabilities globally, and public exploit code is readily available.
What products are affected by CVE-2017-9248?
CVE-2017-9248 affects Progress Sitefinity versions prior to 10.0.6412.0 and Telerik UI for ASP.NET AJAX versions up to and including 2017.2.503. Any web application using the vulnerable Telerik.Web.UI.dll component is potentially at risk.
How do I fix CVE-2017-9248?
Upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP1 or later, and Sitefinity to version 10.0.6412.0 or later. After patching, rotate the DialogParametersEncryptionKey and ASP.NET MachineKey, as they may have been compromised. Restrict access to Telerik handler endpoints using WAF rules.
How severe is CVE-2017-9248?
CVE-2017-9248 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. The combination of remote exploitability, no authentication requirement, and full impact on confidentiality, integrity, and availability makes this an extremely dangerous vulnerability requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.