CVE-2017-9248criticalunder attackCWE-522

CVE-2017-9248

Published · Updated

Follow this CVE+ Monitor ASP.NET AJAX and Sitefinity

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 75%
from disclosure to weapon197 days
Published on NVDJul 3
1st PoC+197d
CISA KEV+1584d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A security flaw in Progress Telerik UI for ASP.NET AJAX fails to properly protect encryption keys, allowing attackers to steal important security credentials and then upload malicious files, steal data, or inject malicious code into web pages.

Technical detail

CVE-2017-9248 involves improper protection of Telerik.Web.UI.DialogParametersEncryptionKey and MachineKey in affected versions, enabling remote attackers to decrypt sensitive material and compromise cryptographic protections. Exploitation can lead to MachineKey disclosure, arbitrary file operations, XSS, or ViewState tampering without authentication requirements.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.