CVE-2019-18935

CVE-2019-18935: Telerik UI for ASP.NET AJAX RadAsyncUpload Deserialization RCE

AI-generated analysis based on the vulnerability data on this page.

Summary

Progress Telerik UI for ASP.NET AJAX through version 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. Successful exploitation yields remote code execution (RCE) on the target web server, but requires knowledge of the application's encryption keys. This prerequisite is commonly satisfied through the related vulnerabilities CVE-2017-11317 or CVE-2017-11357, or by other key-recovery techniques.

Background

Telerik UI for ASP.NET AJAX is a widely-used commercial control suite for building ASP.NET web applications. The RadAsyncUpload component provides asynchronous file-upload capabilities. In affected versions, the component deserializes attacker-controlled input using JavaScriptSerializer without adequate validation, a classic deserialization weakness in the .NET ecosystem.

Root Cause

CWE-502: Deserialization of Untrusted Data

The RadAsyncUpload handler accepts a serialized object from the client and passes it to JavaScriptSerializer.Deserialize(). Because the serializer type list is not sufficiently restricted, an attacker can craft a payload that instantiates arbitrary .NET types during deserialization. In the presence of known gadget chains (for example, those leveraging TypeConfuseDelegate or ObjectDataProvider), this leads directly to arbitrary code execution in the application pool identity.

The encryption-key prerequisite exists because the payload must be encrypted with the same keys used by the Telerik DialogParameters or RadAsyncUpload encryption routines. When these keys are at their known default values, or have been recovered, the server will successfully decrypt and process the malicious payload.

Impact

• Confidentiality: High — attacker can read arbitrary files, extract connection strings, and access backend data.
• Integrity: High — attacker can modify application logic, backdoor assemblies, and alter persisted data.
• Availability: High — attacker can terminate processes, crash the application pool, or deploy ransomware.

The CVSS v3 vector scores this vulnerability at 9.8 Critical because it is network-exploitable with low complexity, requires no privileges, and needs no user interaction.

Exploitation Walkthrough

Ethics caveat: The information below is provided for defensive purposes only. Do not test against systems you do not own or have explicit, documented permission to assess.

1. Key recovery or confirmation: Determine whether the Telerik encryption keys are known. This may involve:

   • Confirming the application is also affected by CVE-2017-11317 (hardcoded default keys) or CVE-2017-11357 (weak key derivation).
   • Brute-forcing the Telerik.Web.UI.DialogParametersEncryptionKey and Telerik.AsyncUpload.ConfigurationEncryptionKey values if short or predictable.

2. Gadget-chain selection: Identify a suitable .NET deserialization gadget chain compatible with the target framework version. Common research frameworks maintain lists of proven gadgets for various .NET versions.

3. Payload construction: Build a serialized object that triggers the gadget chain. Encrypt the payload with the recovered keys using the same algorithm and key-derivation routine the Telerik control expects.

4. Delivery: Submit the encrypted payload to the RadAsyncUpload handler via the standard async-upload POST flow. The server decrypts, deserializes, and executes the embedded command.

5. Verification from a defender's perspective: Monitor for unexpected POST requests to Telerik.Web.UI.WebResource.axd or RadAsyncUploadHandler.ashx containing large, high-entropy encrypted blobs, especially when paired with subsequent out-of-band DNS or HTTP callbacks.

Affected and Patched Versions

In 2020.1.114, a default configuration change prevents the exploit by disabling dangerous deserialization. In 2019.3.1023 only, administrators can apply a non-default setting to block exploitation, but this mitigation is not available in earlier releases.

Remediation

1. Upgrade to Telerik UI for ASP.NET AJAX 2020.1.114 or later. This is the definitive fix.

2. If immediate patching is not possible (2019.3.1023 only):

   • Apply the non-default hardening setting described in the Telerik knowledge-base article to restrict deserialization.
   • Rotate the DialogParametersEncryptionKey and AsyncUpload encryption keys to long, random values that are not derivable from public research.

3. Compensating controls:

   • Place the upload handler behind an authenticated endpoint if business requirements allow.
   • Restrict egress from the web-tier to impede reverse-shell and exfiltration workflows.
   • Apply ASP.NET request-validation and file-extension whitelisting at the IIS/ASP.NET level as defence-in-depth.

Detection

• Web-server logs: Look for POST requests to Telerik.Web.UI.WebResource.axd or async-upload endpoints that carry unusually large rauPostData parameters.
• WAF rules: Implement signatures for known CVE-2019-18935 payload patterns (high-entropy base64 blobs containing serialized ObjectStateFormatter or LosFormatter-style markers).
• Endpoint detection: Monitor the worker process (w3wp.exe) for anomalous child-process spawning, especially cmd.exe, powershell.exe, or unexpected outbound connections.
• Threat-intelligence feeds: Correlate external scanning activity against CISA KEV and EPSS high-percentile indicators.

Assessment

With an EPSS score of 0.99737, this vulnerability is among the most reliably exploited flaws in the wild. Its inclusion in the CISA Known Exploited Vulnerabilities catalog since November 2021 confirms active, ongoing exploitation by multiple threat actors. The prevalence of legacy Telerik deployments in government and enterprise environments makes this a persistent attack surface.

Key lessons:

1. Deserialization of untrusted data remains one of the most dangerous vulnerability classes in modern web applications. Frameworks must use allow-list type resolution, not deny-listing.
2. Hardcoded or weakly-derived encryption keys amplify the impact of otherwise complex vulnerabilities. Cryptographic secrets should be unique per deployment and rotated on a regular schedule.

References

• http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
• https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
• https://github.com/bao7uo/RAU_crypto
• https://github.com/noperator/CVE-2019-18935
• https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
• https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/
• https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
• https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29
• https://www.telerik.com/support/whats-new/release-history
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935