Telerik RadAsyncUpload Flaws Enable Arbitrary File Upload and Potential Code Execution
Vulnerability Disclosure · 3 sources · Updated 22d ago · First seen Jan 23, 2018
Two vulnerabilities in Progress Telerik UI for ASP.NET AJAX expose the RadAsyncUpload component to arbitrary file uploads and potential remote code execution. CVE-2017-11317 involves weak encryption, including default cryptographic keys, while CVE-2017-11357 involves insufficient input restrictions and insecure direct object references. The CVE records identify affected releases before R1 2017 and R2 releases before R2 2017 SP2 for CVE-2017-11317, and versions before R2 2017 SP2 for CVE-2017-11357.
Exploit-DB entry 43874 publishes RAU_crypto.py, a proof-of-concept tool that constructs encrypted upload configuration data and selects a temporary destination folder for uploaded files. Its metadata reports testing on versions 2012.3.1308 through 2017.1.118; source comments identify removal of default keys in 2017.2.621 and an option to disable RadAsyncUpload in 2017.2.711. Organizations should inventory applications using Telerik.Web.UI, upgrade affected deployments to a supported release, and disable RadAsyncUpload where unnecessary. These references document vulnerabilities and public exploit tooling, not a specific intrusion or active exploitation campaign.
