BDU%3A2020-02118

Risk Scores

Affected Products

Exploit Intelligence

• Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935) (github-poc-repo)
• The insecure deserialization of JSON objects in Telerik UI for ASP.NET results in arbitrary remote code execution. An attacker can break the RadAsyncUpload encryption (or have prior knowledge of your custom encryption keys) and stage a malicious request. Affects: v2011.1.315 - 2017.2.621 without keys v2011.1.315 - 2020.1.114 with encryption keys Big Ups: Markus Wulftange (@mwulftange) && Paul Taylor (@bao7uo) Ref: https://github.com/noperator/CVE-2019-18935 See: https://github.com/bao7uo/RAU_... (nmap-nse)
• kev.json (github-poc)
• data.js (github-poc)

Timeline

• May 15, 2020 CVE Published
• May 17, 2020 PoC Published
• Sep 24, 2024 CVE Updated

References

• https://xakep.ru/2020/04/24/web-shells/ url
• https://www.exploit-db.com/exploits/43874 url
• https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference url
• https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv url