Telerik UI for ASP.NET AJAX 2009.1.311 < 2026.2.708 RadChart ChartImage.axd File Read

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351481);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id("CVE-2026-14932");

  script_name(english:"Telerik UI for ASP.NET AJAX 2009.1.311 < 2026.2.708 RadChart ChartImage.axd File Read");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a web application development framework that is affected by an information disclosure
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2009.1.311 or later and
prior to 2026.2.708. It is, therefore, affected by an information disclosure vulnerability. The obsolete RadChart
component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files
within the application directory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radchart-hardcoded-key-file-read-cve-2026-14932
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2406f6f6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.2.708 (2026 Q2 SP1) or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14932");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:telerik:ui_for_asp.net_ajax");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("telerik_ui_for_aspnet_ajax_installed.nbin");
  script_require_keys("installed_sw/Telerik UI for ASP.NET AJAX", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The advisory documents configuration preconditions and workarounds that cannot be checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Telerik UI for ASP.NET AJAX', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2009.1.311', 'fixed_version': '2026.2.708'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);