CVE-2017-11317

🗓️ 23 Aug 2017 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1333 Views🌐 WEB

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, allowing remote attackers to perform arbitrary file uploads or execute arbitrary code

Reporter	Title	Published	Views	Family All 42
zdt	Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization Exploit	21 Oct 202000:00	–	zdt
GithubExploit	Exploit for Inadequate Encryption Strength in Telerik Ui_For_Asp.Net_Ajax	9 Jan 201813:53	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Telerik Ui_For_Asp.Net_Ajax	29 May 202007:29	–	githubexploit
ICS	Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers	15 Jun 202312:00	–	ics
ICS	Hitachi ABB Power Grids eSOMS Telerik	18 Mar 202100:00	–	ics
ATTACKERKB	CVE-2019-18935	11 Dec 201900:00	–	attackerkb
ATTACKERKB	CVE-2017-11317	23 Aug 201700:00	–	attackerkb
BDU FSTEC	The vulnerability of the Telerik UI software for ASP.NET AJAX, related to the encryption flaws in RadAsyncUpload, allows attackers to perform arbitrary file uploads or execute arbitrary code.	15 May 202000:00	–	bdu_fstec
Circl	CVE-2017-11317	20 Oct 202015:57	–	circl
CISA KEV Catalog	Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability	11 Apr 202200:00	–	cisa_kev

NVD

Node

telerik ui_for_asp.net_ajaxRange≤2016.3.1027

telerik ui_for_asp.net_ajaxMatch2017.2.503

telerik ui_for_asp.net_ajaxMatch2017.2.621

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
telerik	www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload
exploit-db	www.exploit-db.com/exploits/43874/
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
type	query param	/Telerik.Web.UI.WebResource.axd	Weak encryption enables unrestricted file upload via RAU (CVE-2017-11317).	CWE-326
rauPostData	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326
file	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326
fileName	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326
contentType	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326
lastModifiedDate	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326
metadata	request body	/Telerik.Web.UI.WebResource.axd	Multipart upload used by RAU for uploading a DLL payload leading to potential arbitrary code execution (CVE-2017-11317/CVE-2019-18935 context).	CWE-326