Loading vulnerability…
CVE-2017-11317 is a vulnerability in Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX affecting versions before R1 2017 and R2 2017 before R2 2017 SP2. The flaw stems from weak protection of the RadAsyncUpload component, including use of a hard-coded default cryptographic key in affected versions. Because the async upload metadata can be forged when the key material is known or recoverable, a remote attacker can craft valid upload requests to the Telerik WebResource/RadAsyncUpload handler and control upload parameters such as the destination path. This enables arbitrary file upload and, in practical exploitation chains, placement of attacker-controlled files on the server. The vulnerability is frequently used as a precursor to further exploitation of Telerik deserialization issues, but it is independently described as allowing arbitrary file upload and possible remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a Python exploit script (mass.py) targeting CVE-2017-11317, an insecure direct object reference vulnerability in Telerik UI for ASP.NET AJAX. The script is designed to automate the process of identifying and exploiting vulnerable Telerik installations by brute-forcing the encryption key used by the component. It reads a list of target URLs or IP addresses from a file, then uses multithreading to send crafted HTTP GET requests with a specially encoded 'dp' parameter to each target. The script analyzes the error messages in the HTTP responses to determine if the guessed key is correct. If a vulnerable target is found, its URL is saved to an output file. The script is operational and can be used to identify and exploit vulnerable Telerik installations at scale. The only other file in the repository is a README.md, which briefly references the CVE and provides a link to a relevant Telerik support article.
This repository contains a single Metasploit module: 'telerik_rau_deserialization.rb', which exploits deserialization and cryptographic key management vulnerabilities in the RadAsyncUpload (RAU) component of Telerik UI for ASP.NET AJAX (CVE-2019-18935 and CVE-2017-11317). The module is highly weaponized, allowing an attacker to upload a malicious .NET DLL to the target server and achieve remote code execution, typically via a Meterpreter reverse shell. The exploit requires knowledge of the RAU cryptographic keys (default keys are provided for unpatched systems) and the version of Telerik UI in use. The module interacts with the target via HTTP(S), specifically targeting the '/Telerik.Web.UI.WebResource.axd?type=rau' endpoint, and uploads payloads to a specified directory (default: 'C:\Windows\Temp'). The code is written in Ruby and is structured as a standard Metasploit exploit module, leveraging Metasploit's HttpClient, EXE, and FileDropper mixins. The repository is focused, containing only the exploit module file.
This repository contains a Python exploit script (RAU_crypto.py) targeting multiple vulnerabilities in Telerik UI for ASP.NET AJAX, specifically CVE-2017-11317, CVE-2017-11357 (arbitrary file upload and insecure direct object reference), and CVE-2019-18935 (.NET deserialization). The exploit enables attackers to upload arbitrary files to the server and execute arbitrary code via deserialization of attacker-supplied .NET assemblies, either from local or remote (SMB) sources. The script supports custom payloads, encryption/decryption of rauPostData, and can test for the target's ability to load remote payloads. The README provides detailed usage instructions, example commands, and context about the vulnerabilities. The main attack vector is network-based, targeting the Telerik WebResource.axd endpoint. The repository is operational and suitable for real-world exploitation given the correct target configuration and knowledge of required keys.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Telerik UI for ASP.NET vulnerability used in attempted remote code execution against the Jordanian Ministry of Justice.
A vulnerability in Telerik UI exploited by threat actors for initial access in payment infrastructure attacks (Silent Skimmer campaign).
An arbitrary file upload vulnerability in Telerik UI for ASP.NET AJAX (RAU/WebResource handler) enabled by a hard-coded default key, often used as a stepping stone to remote code execution.
An older Telerik Web UI vulnerability referenced as part of the same broader RadAsyncUpload-related attack surface and as a possible precursor to obtaining keys needed for later exploitation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.