Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attack…

published 2017-08-23 9 y ago modified 2026-08-14 2 mo ago also EUVD-2017-2986

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2023-01-26, used in ransomware
epss: 77.7%; EPSS 77.7% chance of exploitation in 30 days, percentile 99.5%
public exploits: 1; Exploit-DB

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

progress telerik_ui_for_asp.net_ajax 2020.1.114

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-077-03 updated 2021-03-18 cvss 9.8

Hitachi ABB Power Grids eSOMS Telerik

Hitachi Energy eSOMS < 6.3 of telerik software
affected: vendor fix, mitigation “For additional information and support, contact a product provider or Hitachi ABB Power Grids service organization. For contact information, visit Hitachi ABB Power Grids contact-centers.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2017-08-23 Published
2018-01-24 First public exploit (EDB-43874)
2021-01-22 CISA SSVC: exploitation active
2023-01-26 Added to CISA KEV
2023-02-16 CISA patch deadline

Known exploited

Added: 3 y ago (2023-01-26)
Patch by: 2023-02-16 (3 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Telerik, User Interface (UI) for ASP.NET AJAX
CISA name: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 5 y ago (2021-01-22)

Exploit prediction

77.68% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-43874 Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload webapps, 2018-01-24

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

exploit-db.com /exploits/43874/
exploit, third-party-advisory, vdb-entry
telerik.com /support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
mitigation, vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357
government-resource, us-government-resource

Sources

CVE List CVE-2017-11357
NVD CVE-2017-11357

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary