Detections
Analytics
Telerik UI for ASP.NET AJAX RadAsyncUpload Multiple Vulnerabilities
critical Web App Scanning Plugin ID 112522
Language:
Synopsis
Telerik UI for ASP.NET AJAX RadAsyncUpload Multiple VulnerabilitiesDescription
According to its self-reported version number, the version of Telerik UI for ASP.NET AJAX is affected by multiple vulnerabilities in Telerik.Web.UI.dll :- An insecure direct object reference vulnerability due to user input used directly by RadAsyncUpload without modification or validation. (CVE-2017-11357)
- An unrestricted file upload due to weak encryption used in old versions of Telerik.Web.UI to encrypt data used by RadAsyncUpload. (CVE-2017-11317) An unauthenticated, remote attacker can exploit this, via specially crafted data, to execute arbitrary code.
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Telerik UI for ASP.NET AJAX version R2 2017 SP2 (2017.2.711) or later, and follow the RadAsyncUpload security article and set all encryption keys.See Also
https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security
https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload
Plugin Details
Severity: Critical
ID: 112522
Type: remote
Family: Component Vulnerability
Published: 7/1/2020
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2017-11317
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2017-11317
Vulnerability Information
CPE: cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/23/2017
Vulnerability Publication Date: 8/23/2017
CISA Known Exploited Vulnerability Due Dates: 5/2/2022, 2/16/2023
Reference Information
CVE: CVE-2017-11317, CVE-2017-11357
OWASP: 2010-A2, 2010-A4, 2010-A7, 2013-A3, 2013-A4, 2013-A6, 2013-A9, 2017-A3, 2017-A5, 2017-A7, 2017-A9, 2021-A2, 2021-A3, 2021-A6
WASC: Application Misconfiguration, Cross-Site Scripting, Improper Input Handling
CAPEC: 10, 101, 104, 108, 109, 110, 112, 120, 13, 135, 136, 14, 153, 182, 192, 20, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 45, 46, 47, 473, 52, 53, 588, 591, 592, 63, 64, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002440, APSC-DV-002490, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.10.1.2, 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SC-12, sp800_53-SI-10
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3, 4.0.2-5.3.3, 4.0.2-9.1.2