9.8

CVE-2019-18935

Warnung
Medienbericht
Exploit
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Telerik ≫ Ui For Asp.Net Ajax Version >= 2011.1.315 <= 2020.1.114

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Schwachstelle

Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.74% 1
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
Not Applicable
https://github.com/bao7uo/RAU_crypto
Third Party Advisory
Exploit
https://github.com/noperator/CVE-2019-18935
Third Party Advisory
Exploit
https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
Third Party Advisory
Exploit
https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/
Press/Media Coverage
https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
Patch
Vendor Advisory
https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29
Release Notes
https://www.telerik.com/support/whats-new/release-history
Vendor Advisory
Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935
US Government Resource