CVE-2017-11357: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
First published: Wed Aug 23 2017(Updated: )
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Progress Telerik UI for ASP.NET AJAX | <2020.1.114 | |
| Progress Telerik UI for ASP.NET AJAX | <=2017.2.621 | |
| Telerik UI for ASP.NET AJAX |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
- https://www.exploit-db.com/exploits/43874/
- https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference;
- https://nvd.nist.gov/vuln/detail/CVE-2017-11357
Frequently Asked Questions
What is the severity of CVE-2017-11357?
CVE-2017-11357 is considered a critical vulnerability due to its potential for arbitrary file uploads and code execution.
How do I fix CVE-2017-11357?
To fix CVE-2017-11357, users should upgrade to Telerik UI for ASP.NET AJAX versions later than R2 2017 SP2.
What kind of attacks can CVE-2017-11357 enable?
CVE-2017-11357 can enable remote attackers to perform arbitrary file uploads and execute arbitrary code on the server.
Which versions of Telerik UI for ASP.NET AJAX are affected by CVE-2017-11357?
CVE-2017-11357 affects Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2, including all versions up to 2017.2.621.
Is authentication necessary for exploiting CVE-2017-11357?
No, CVE-2017-11357 can be exploited by an unauthenticated attacker, making it particularly dangerous.
- agent/type
- agent/description
- agent/title
- agent/author
- agent/weakness
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/tags
- agent/softwarecombine
- vendor/telerik
- canonical/progress telerik ui for asp.net ajax
- version/progress telerik ui for asp.net ajax/2017.2.621
- canonical/telerik ui for asp.net ajax