Actively exploited · Published Aug 23, 2017 · Assigned by mitre
CVE-2017-11357
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity unrestricted file upload in User Interface (UI) for ASP.NET AJAX from Telerik. Attackers are actively exploiting it in the wild (listed by CISA on January 26, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 77.7% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Feb 16, 2023.
Official description
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 43874 exploit, x_refsource_EXPLOIT-DB
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357 government-resource