Telerik UI for ASP.NET AJAX < 2026.3.812 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342661);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/04");

  script_cve_id("CVE-2026-18672", "CVE-2026-19219");
  script_xref(name:"IAVA", value:"2026-A-0937");

  script_name(english:"Telerik UI for ASP.NET AJAX < 2026.3.812 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a web application development framework that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.3.812. It is,
therefore, affected by multiple vulnerabilities:

  - In Progress Telerik UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in
    RadImageEditor may allow an attacker to influence which file is returned by the control's image cache,
    potentially exposing file contents outside the intended image directories. (CVE-2026-18672)

  - In Progress Telerik UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request
    parameters used by the RadEditor file browser may allow an attacker who has obtained certain application
    encryption key material to alter the folders the file browser reads from, writes to, and uploads into,
    potentially resulting in remote code execution. (CVE-2026-19219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rie-path-traversal-cve-2026-18672
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4471d95c");
  # https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-uploadpaths-tampering-cve-2026-19219
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0f51af9");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.3.812 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-18672");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-19219");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:telerik:ui_for_asp.net_ajax");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("telerik_ui_for_aspnet_ajax_installed.nbin");
  script_require_keys("installed_sw/Telerik UI for ASP.NET AJAX", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The advisories document configuration preconditions and workarounds that cannot be checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Telerik UI for ASP.NET AJAX', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2011.2.712', 'max_version': '2026.2.708', 'fixed_version': '2026.3.812'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);