CVE-2017-11357

CVE-2017-11357 is a critical-severity vulnerability in Progress Telerik Ui For Asp.net Ajax with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-01-26). The underlying weakness is classified as CWE-434.

Key facts

Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVE-2017-11357: Unrestricted File Upload in Telerik UI for ASP.NET AJAX RadAsyncUpload

AI-generated analysis based on the vulnerability data on this page.

Summary

Progress Telerik UI for ASP.NET AJAX contains an unrestricted file upload vulnerability in the RadAsyncUpload control. Versions prior to R2 2017 SP2 fail to properly restrict user input, allowing remote attackers to upload arbitrary files and potentially execute code on the server.

Background

Telerik UI for ASP.NET AJAX is a widely used commercial suite of user interface controls for ASP.NET web applications. The RadAsyncUpload component provides asynchronous file upload capabilities. When improperly configured or lacking server-side validation, this component becomes a high-risk attack surface for web applications handling user-submitted content.

Root Cause

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The RadAsyncUpload control does not enforce adequate restrictions on uploaded file types or contents. An attacker can submit files with executable extensions—such as ASPX—which the server may process, leading to remote code execution. The flaw stems from missing or insufficient validation logic on the upload handler.

Impact

The Common Vulnerability Scoring System (CVSS) v3.1 score is 9.8, rated Critical. The attack vector is network-based, requires no authentication, no privileges, and no user interaction. Successful exploitation results in high impacts across confidentiality, integrity, and availability. An attacker can read sensitive data, modify application behavior, or render the application unavailable.

Exploitation Walkthrough

This flaw is typically exploited by sending crafted HTTP requests to the RadAsyncUpload handler endpoint with a malicious file payload. Because authentication is not required, the attack can be conducted remotely by anyone with network access to the application. The uploaded file may then be accessed via a predictable URL or directory path, allowing the server to execute it. Ethics caveat: This information is provided for defensive purposes only. Testing must be performed exclusively on systems you own or have explicit written permission to assess.

Affected and Patched Versions

Affected versions include all releases of Progress Telerik UI for ASP.NET AJAX prior to R2 2017 SP2. The vendor addressed the issue in the R2 2017 SP2 update. Administrators should confirm their exact version against the vendor’s release notes, as earlier patch levels remain vulnerable.

Remediation

The primary remediation is to upgrade to Progress Telerik UI for ASP.NET AJAX R2 2017 SP2 or a later supported release. Until patching is complete, apply compensating controls: restrict uploaded file types through server-side allow lists, disable execution permissions on upload directories, deploy a Web Application Firewall (WAF) with rules targeting known RadAsyncUpload exploitation patterns, and monitor upload logs for suspicious file extensions.

Detection

Security teams can detect exploitation attempts by monitoring web server logs for POST requests to RadAsyncUpload handler paths that contain unexpected file extensions. File integrity monitoring on upload directories can alert when new executable files appear. Additionally, review the version of the Telerik.Web.UI assembly; if it predates R2 2017 SP2, the system is likely vulnerable.

Assessment

This vulnerability carries an Exploit Prediction Scoring System (EPSS) probability of 0.75709, or approximately 75.7%, placing it in the 99.5th percentile of observed CVEs. It was added to the CISA Known Exploited Vulnerabilities Catalog on 2023-01-26 and is marked as exploited in the European Union vulnerability database from the same date. The high EPSS score and active exploitation in the wild make immediate patching a priority. Key lessons include the need for strict server-side validation on all file upload paths and the importance of maintaining commercial component inventories to track security updates.

References

Frequently asked questions

What is CVE-2017-11357?
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
How severe is CVE-2017-11357?
CVE-2017-11357 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-11357 being actively exploited?
Yes. CVE-2017-11357 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-01-26, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2017-11357?
CVE-2017-11357 affects Progress Telerik Ui For Asp.net Ajax. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-11357?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2017-11357 have an EU (EUVD) identifier?
Yes. CVE-2017-11357 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2017-2986. It is also flagged as exploited in the EUVD (since 2023-01-26).
When was CVE-2017-11357 published?
CVE-2017-11357 was published on 2017-08-23 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Progress Telerik Ui For Asp.net Ajax

All CVEs affecting Progress Telerik Ui For Asp.net Ajax →

Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities

Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →