Telerik UI for ASP.NET AJAX RadAsyncUpload Weak Encryption Remote Code Execution (RCE) - CVE-2017-11317
Executive & SecOps Summary
SECOPS ASSESSMENTProgress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2
Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server
Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Telerik UI for ASP.NET AJAX components to R1 2017 SP1, R2 2017 SP2, or later. Use the NuGet Package Manager Console to update the package:
# Update Telerik UI package via NuGet Package Manager Console
Update-Package Telerik.Web.UI -Version 2017.2.7112. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, secure the RadAsyncUpload control by defining unique, cryptographically strong keys in your web.config file:
<!-- Define strong custom keys in the appSettings section of web.config -->
<appSettings>
<add key='Telerik.Web.UI.AsyncUpload.ConfigurationEncryptionKey' value='YourSuperSecretAndVeryLongKeyHere1234567890!' />
<add key='Telerik.Upload.ConfigurationEncryptionKey' value='AnotherSuperSecretAndVeryLongKeyHere1234567890!' />
</appSettings>3. Log Audit & IoC Verification Commands
Monitor IIS logs for suspicious POST requests targeting the RadAsyncUpload.ashx handler. Use the following PowerShell script to locate and verify the version of Telerik.Web.UI.dll deployed on your servers:
# Search for Telerik.Web.UI.dll and output its version
Get-ChildItem -Path 'C:\inetpub\wwwroot' -Filter 'Telerik.Web.UI.dll' -Recurse | ForEach-Object {
[System.Diagnostics.FileVersionInfo]::GetVersionInfo($_.FullName) | Select-Object FileName, ProductVersion
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the RadAsyncUpload control of the Telerik.Web.UI component. The root cause is the use of weak encryption (CWE-326) and predictable default keys when securing metadata associated with file upload requests. This allows attackers to forge valid upload configurations and bypass security controls.
2. Exploitation Mechanics & Attack Scenario
An attacker intercepts the 'raUploaderData' parameter sent during a RadAsyncUpload operation. By leveraging the weak encryption or known default keys, the attacker decrypts, manipulates, and re-encrypts the metadata to point to an arbitrary location or include serialized payloads. Upon receiving the forged request, the server processes it, leading to unrestricted file upload or .NET deserialization, resulting in Remote Code Execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and active exploitation documented in CISA's KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants the attacker web server privileges, enabling lateral movement, data exfiltration, and full system compromise.
Official Vendor Advisories & References
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Frequently Asked SecOps Questions (CVE-2017-11317)
FAQQ1. How critical is CVE-2017-11317 and is it actively exploited in the wild?
CVE-2017-11317 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 84.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-11317?
Primary impacted vendors include progress, telerik across telerik_ui_for_asp.net_ajax. Scope summary: Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 (Telerik.Web.UI.dll)
Q3. What temporary mitigations or workarounds exist for CVE-2017-11317 before patching?
[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-11317
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.