CVE-2017-11357

progress telerik ui for asp.net ajax

Published 23 Aug 2017 · updated 14 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 26 Jan 2023, with a remediation deadline of 16 Feb 2023 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

References

www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference · Mitigation, Vendor Advisory
www.exploit-db.com/exploits/43874/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357 · US Government Resource