Actively exploited · Published Jul 3, 2017 · Assigned by mitre

CVE-2017-9248

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in ASP.NET AJAX and Sitefinity from Progress. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 75.1% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)75.1%top 0.5% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness x_refsource_CONFIRM
43873 exploit, x_refsource_EXPLOIT-DB
http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity x_refsource_CONFIRM
99965 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248 government-resource