CVE-2017-11357

Critical9.8Published on August 23, 2017

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jan 26, 2023
US federal agencies must remediate it by Feb 16, 2023 (BOD 22-01)
First attack observed 1153 days after disclosure
Used in ransomware campaigns

Apply updates per vendor instructions.

Source: CISA KEV · Nov 25, 2024 Jun 15, 2024 Mar 15, 2023 Jan 26, 2023 Oct 20, 2020

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-434, CWE-434

Vendorsprogress

Affected products

Vendors	Product	Versions
progress	telerik ui for asp.net ajax	< 2020.1.114

Vulnerabilities

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE

Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.

Sep 7, 202615:126 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE