CVE-2017-11357 Details
Description
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
A vulnerability exists in Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2, specifically within the RadAsyncUpload component. The issue arises from improper input validation, enabling remote attackers to upload arbitrary files or execute arbitrary code. This vulnerability is linked to a hardcoded encryption key that can be exploited to bypass security measures, as detailed in a blog post by Paul Taylor of Foregenix Ltd.
Users are advised to upgrade to R2 2017 SP2 (2017.2.711) or later. For versions between Q1 2011 (2011.1.315) and R2 2017 SP1 (2017.2.621), a patch is available. After upgrading or applying the patch, file uploads can be disabled through the Telerik handler, and a custom handler can be created with the desired level of security.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2021References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357 | CISA-ADP | US Government Resource |
| https://www.exploit-db.com/exploits/43874/ | CVE | ExploitThird Party AdvisoryVDB Entry |
| http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference | CVE | MitigationVendor Advisory |
| https://www.exploit-db.com/exploits/43874/ | [email protected] | ExploitThird Party AdvisoryVDB Entry |
| http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference | [email protected] | MitigationVendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability | Jan 26, 2023 | Feb 16, 2023 | Apply updates per vendor instructions. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| progress telerik ui for asp.net ajax | < 2020.1.114 |
CPE
Remediation
| |
Change History
15 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 14, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Modified Analysis | [email protected] |
| Oct 22, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Mar 14, 2025 | Modified Analysis | [email protected] |
| Feb 7, 2025 | CVE Modified | CISA-ADP |
| Jan 22, 2025 | Modified Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 28, 2024 | Modified Analysis | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| Jan 28, 2018 | CVE Modified | [email protected] |
| Sep 1, 2017 | Initial Analysis | [email protected] |