CVE-2019-18935
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Description
CVE-2019-18935 is a critical deserialization vulnerability in Progress Telerik UI for ASP.NET AJAX that allows remote code execution through the RadAsyncUpload component. The vulnerability is exploitable when encryption keys are known, which can occur due to the presence of related vulnerabilities CVE-2017-11317 or CVE-2017-11357. Successful exploitation enables attackers to execute arbitrary code on the server in the context of the w3wp.exe process. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it has been associated with ransomware campaigns. With an EPSS score of 93.58% (99.83rd percentile), this Telerik UI deserialization vulnerability has a near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| telerik | ui for asp.net ajax | >= 2011.1.315, <= 2020.1.114 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html(Not Applicable)
- https://github.com/bao7uo/RAU_crypto(Exploit, Third Party Advisory)
- https://github.com/noperator/CVE-2019-18935(Exploit, Third Party Advisory)
- https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui(Exploit, Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/(Press/Media Coverage)
- https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization(Patch, Vendor Advisory)
- https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29(Release Notes)
- https://www.telerik.com/support/whats-new/release-history(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of untrusted data occurs when an application deserializes data from an untrusted source without sufficient verification. In the case of CVE-2019-18935, the RadAsyncUpload function in Telerik UI for ASP.NET AJAX deserializes .NET objects without proper validation, allowing attackers to craft malicious serialized payloads that trigger remote code execution when processed by the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2019-18935 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting maximum severity across nearly all dimensions. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, meaning any attacker who can reach the web application can attempt exploitation. Successful attacks result in remote code execution in the context of the IIS worker process (w3wp.exe), with high impact to confidentiality, integrity, and availability — attackers can access sensitive data, deploy webshells or backdoors, modify application behavior, and disrupt service operations. Critically, this vulnerability has been associated with known ransomware campaigns, significantly elevating the risk for organizations with unpatched Telerik UI deployments. The EPSS score of 93.58% places this vulnerability at the 99.83rd percentile, indicating near-certain active exploitation. This vulnerability has been notably exploited against U.S. federal agencies, underscoring the severity of the threat.
Exploit Maturity
CVE-2019-18935 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware attacks. Public exploit code is available via Packet Storm Security and through exploit tools on GitHub including RAU_crypto and a dedicated exploitation tool. Additional technical analysis is available from Bishop Fox. The EPSS score of 93.58% (99.83rd percentile) indicates near-certain exploitation activity. This vulnerability is commonly chained with CVE-2017-11317 or CVE-2017-11357, which expose the encryption keys needed to craft the malicious deserialization payload. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Telerik UI for ASP.NET AJAX to version 2020.1.114 or later, which includes a default setting that prevents exploitation.
- Verify that all instances of Telerik UI for ASP.NET AJAX have been updated from affected versions (2011.1.315 through 2020.1.114). For version 2019.3.1023, ensure the non-default protective setting is explicitly enabled if upgrading to 2020.1.114 is not immediately possible.
- Rotate all Telerik encryption keys, as the existing keys may have been compromised through CVE-2017-11317 or CVE-2017-11357. Ensure new keys are cryptographically strong and not reused across environments. Implement integrity checks on serialized data to prevent deserialization attacks.
- Monitor IIS logs and w3wp.exe process activity for indicators of compromise, including suspicious file uploads through RadAsyncUpload, unexpected webshell deployments, and unauthorized process spawning from the IIS worker process. Scan web application directories for unauthorized files.
- As a long-term measure, implement network segmentation to isolate web application servers, deploy a web application firewall (WAF) with rules targeting deserialization payloads, and avoid using binary serialization formats for handling untrusted data in .NET applications.
Technical Details
CVE-2019-18935 is a .NET deserialization vulnerability in the RadAsyncUpload function of Progress Telerik UI for ASP.NET AJAX, affecting versions through 2019.3.1023. The vulnerability exploits the JavaScriptSerializer deserialization mechanism to execute arbitrary code when an attacker can craft a malicious serialized object. The attack requires knowledge of the application's encryption keys, which can be obtained through related vulnerabilities CVE-2017-11317 or CVE-2017-11357. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is network-based, requires no privileges or user interaction, and has maximum impact across confidentiality, integrity, and availability. Code execution occurs in the context of the w3wp.exe process (IIS worker), giving attackers the privileges of the web application. Version 2020.1.114 introduced a default configuration change that prevents the exploit, while version 2019.3.1023 includes a non-default setting that can also mitigate the risk.
Frequently Asked Questions
Is CVE-2019-18935 being actively exploited?
Yes. CVE-2019-18935 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It has been associated with ransomware campaigns and was notably used to compromise U.S. federal agencies. The EPSS score of 93.58% (99.83rd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2019-18935?
CVE-2019-18935 affects Progress Telerik UI for ASP.NET AJAX versions from 2011.1.315 through 2020.1.114. The vulnerability is in the RadAsyncUpload component and is exploitable when encryption keys are known through related vulnerabilities CVE-2017-11317 or CVE-2017-11357.
How do I fix CVE-2019-18935?
Upgrade Telerik UI for ASP.NET AJAX to version 2020.1.114 or later, which includes a default setting preventing exploitation. Rotate all Telerik encryption keys, as they may have been compromised. If running version 2019.3.1023, enable the non-default protective configuration setting.
How severe is CVE-2019-18935?
CVE-2019-18935 has a CVSS 3.1 base score of 9.8 (CRITICAL) and an EPSS score of 93.58% at the 99.83rd percentile. The vulnerability is associated with ransomware campaigns, enables remote code execution without authentication, and requires immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.