Telewreck - A Burp Extension To Detect And Exploit Versions Of Telerik Web UI Vulnerable To CVE-2017-9248

🗓️ 29 Aug 2018 13:33:00Reported by KitPloitType

A Burp extension to detect and exploit versions of Telerik Web UI vulnerable to CVE-2017-9248. Based on the original exploit tool by Paul Taylor

Reporter	Title	Published	Views	Family All 31
GithubExploit	Exploit for Inadequate Encryption Strength in Telerik Ui_For_Asp.Net_Ajax	9 Jan 201813:53	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Telerik Ui_For_Asp.Net_Ajax	29 May 202007:29	–	githubexploit
ICS	Iranian Advanced Persistent Threat Actors Threaten Election-Related Systems	22 Oct 202012:00	–	ics
ICS	Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers	15 Jun 202312:00	–	ics
ICS	Hitachi ABB Power Grids eSOMS Telerik	18 Mar 202100:00	–	ics
ATTACKERKB	CVE-2017-9248	3 Jul 201700:00	–	attackerkb
BDU FSTEC	The vulnerability of the Telerik.Web.UI.dll library of the Telerik UI software for ASP.NET AJAX and the Sitefinity web content management system allows a attacker to exploit the encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or MachineKey).	7 Sep 202100:00	–	bdu_fstec
Circl	CVE-2017-9248	21 Mar 201813:35	–	circl
CISA KEV Catalog	Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	CISA, FBI, and MS-ISAC Update Joint CSA on Progress Telerik Vulnerabilities	15 Jun 202312:00	–	cisa

Source	Link
github	www.github.com/capt-meelo/Telewreck
github	www.github.com/bao7uo/dp_crypto
capt-meelo	www.capt-meelo.github.io/pentest/2018/08/03/pwning-with-telerik.html
raw	www.raw.githubusercontent.com/capt-meelo/Telewreck/master/telewreck.py

29 Aug 2018 13:33Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

EPSS0.75098