CVE-2017-11357

Telerik User Interface (UI) for ASP.NET AJAX: UI for ASP.NET AJAX Insecure Direct Object Reference

As of , CVE-2017-11357 in Telerik User Interface (UI) for ASP.NET AJAX is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 26 January 2023
US federal deadline
16 February 202321 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.78Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.22 on 26 January 2023EPSS on the day CISA listed it.
Public exploit
1 Exploit-DB entry
Fix
Vendor advice: docs.telerik.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

CISA's description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

The CVE record's description, from mitre

CVE published
23 August 2017
Assigned by
mitre
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-20
Improper Input Validation
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 43874).
  3. CISA added it to its list of exploited vulnerabilities.
  4. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

User Interface (UI) for ASP.NET AJAX: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2017-11317UI for ASP.NET AJAX Unrestricted File UploadTelerik User Interface (UI) for ASP.NET AJAXPatch this weekMetasploit module; EPSS 0.840.84

Read further