CVE-2019-18935criticalunder attackransomwareCWE-502

CVE-2019-18935

Published · Updated

Follow this CVE+ Monitor Telerik UI for ASP.NET AJAX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDDec 11
1st PoCJan 9
metasploitDec 9
CISA KEV+693d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBlue Mockingbird MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Progress Telerik UI for ASP.NET AJAX has a flaw in its file upload feature that allows attackers to run malicious code on a server if they know the encryption keys. This happens because the application unsafely processes untrusted data.

Technical detail

CVE-2019-18935 is a .NET deserialization vulnerability (CWE-502) in RadAsyncUpload that permits remote code execution when encryption keys are compromised via CVE-2017-11317, CVE-2017-11357, or equivalent means. The attack vector requires network access and knowledge of encryption keys; exploitation results in arbitrary code execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 34
exploitdbwww.exploit-db.com/exploits/47793unverifiedgithubgithub.com/noperator/CVE-2019-18935★ 372githubgithub.com/bao7uo/RAU_crypto★ 177githubgithub.com/murataydemir/CVE-2019-18935★ 16githubgithub.com/dust-life/CVE-2019-18935-memShell★ 13githubgithub.com/ThanHuuTuan/Telerik_CVE-2019-18935★ 12githubgithub.com/ekkoo-z/CVE-2019-18935-bypasswaf★ 8githubgithub.com/random-robbie/CVE-2019-18935★ 5githubgithub.com/ThanHuuTuan/CVE_2019_18935★ 2githubgithub.com/menashe12346/CVE-2019-18935★ 1githubgithub.com/KasunPriyashan/Telerik-UI-ASP.NET-AJAX-Exploitation★ 1githubgithub.com/quyt0/CVE-2019-18935-exploit-study★ 1githubgithub.com/alanbarret/CVE-2019-18935★ 1githubgithub.com/0xAgun/CVE-2019-18935-checker★ 0githubgithub.com/clarkvoss/telerik★ 0githubgithub.com/appliedi/Telerik_CVE-2019-18935★ 0githubgithub.com/becrevex/Telerik_CVE-2019-18935★ 0githubgithub.com/0xsharz/telerik-scanner-CVE-2019-18935★ 0cve_referencepacketstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.htmlunverifiedcve_referencepacketstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/00b2cc8b8125unverifiedvulncheckvulncheck.com/xdb/de3ebe4e8ea8unverifiedvulncheckvulncheck.com/xdb/6733f1b67fb2unverifiedvulncheckvulncheck.com/xdb/48d2eb3dee46unverifiedvulncheckvulncheck.com/xdb/569e3fec38c8unverifiedvulncheckvulncheck.com/xdb/8dc793fec147unverifiedvulncheckvulncheck.com/xdb/dd4d5145d7fdunverifiedvulncheckvulncheck.com/xdb/dffdf06b5f8aunverifiedvulncheckvulncheck.com/xdb/c621c71a9bf3unverifiedvulncheckvulncheck.com/xdb/9dd5bbcf8c95unverifiedvulncheckvulncheck.com/xdb/1ee9cb96b7b2unverifiedvulncheckvulncheck.com/xdb/3af31675fd50unverifiedvulncheckvulncheck.com/xdb/d2816417f115unverifiedvulncheckvulncheck.com/xdb/d575b87a649aunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.