CVE-2019-18935

CRITICAL CISA KEV EPSS 100.0%
Published Dec 11, 20196y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Dec 11, 2019 6y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Nov 3, 2021 4y ago
KEV Due May 3, 2022 1520d overdue

Description

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 1520d
Added
Nov 3, 2021
Due
May 3, 2022

Apply updates per vendor instructions.

EPSS Exploit Probability
100.0% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
telerikui_for_asp.net_ajax*≥2011.1.315  –  ≤2020.1.114

References 11

  • packetstormsecurity.com http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
    Third Party AdvisoryVDB Entry
  • packetstormsecurity.com http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
    ExploitThird Party AdvisoryVDB Entry
  • codewhitesec.blogspot.com https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
    Not Applicable
  • github.com https://github.com/bao7uo/RAU_crypto
    ExploitThird Party Advisory
  • github.com https://github.com/noperator/CVE-2019-18935
    ExploitThird Party Advisory
  • know.bishopfox.com https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
    ExploitThird Party Advisory
  • bleepingcomputer.com https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/
    Press/Media Coverage
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935
    US Government Resource
  • telerik.com https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
    PatchVendor Advisory
  • telerik.com https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29
    Release Notes
  • telerik.com https://www.telerik.com/support/whats-new/release-history
    Release NotesVendor Advisory

Remediation

  • telerik.com https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
    PatchVendor Advisory