CVE DatabaseCVE-2017-11357

Updated 2026-08-14한국어 권고문 →

CVE-2017-113579.8/CRITICALCISA KEVCWE-434CWE-434

Progress Telerik UI for ASP.NET AJAX RadAsyncUpload Unrestricted File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2017-11357)

⚡ Jump to Patch

Affected Vendors

progress, telerik

Affected Components

telerik_ui_for_asp.net_ajax

Published Date

2017-08-23

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

77.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2

Impact

Unauthenticated remote attackers can exploit the vulnerable RadAsyncUpload component to upload arbitrary malicious files (such as ASPX webshells) and execute arbitrary code with web server privileges

Mitigation

Immediately upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later, or apply workarounds by disabling RadAsyncUpload and hardening encryption keys

Affected Products & Version Scope

All versions of Progress Telerik UI for ASP.NET AJAX prior to R2 2017 SP2 (version 2017.2.711)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The recommended remediation is to upgrade Telerik UI for ASP.NET AJAX to version R2 2017 SP2 (2017.2.711) or later. Run the following command in the NuGet Package Manager Console:

powershell

# Update the Telerik UI package via NuGet Package Manager Console
Update-Package Telerik.UI.for.AspNet.Ajax -Version 2017.2.711

2. Temporary Workaround & Hardening Configuration

If an immediate upgrade is not feasible, secure the application by explicitly defining strong, unique encryption keys in the web.config file to prevent metadata tampering.

xml

<!-- Hardening web.config: Define strong custom keys for RadAsyncUpload encryption -->
<configuration>
  <appSettings>
    <add key='Telerik.Web.UI.AsyncUpload.ConfigurationEncryptionKey' value='YOUR_STRONG_RANDOM_GUID_OR_KEY_HERE' />
    <add key='Telerik.Upload.ConfigurationHashKey' value='YOUR_STRONG_RANDOM_HASH_KEY_HERE' />
  </appSettings>
</configuration>

3. Log Audit & IoC Verification Commands

Inspect IIS access logs for suspicious POST requests targeting the WebResource.axd handler and check for unauthorized files in the temporary upload directories.

bash

# Search IIS logs for suspicious RadAsyncUpload requests returning 200 OK
find /var/log/iis/ -name '*.log' | xargs grep -i 'Telerik.Web.UI.WebResource.axd' | grep -i 'AsyncUpload'

# Scan the temporary upload directory for unexpected .aspx or .tmp files
find ./App_Data/RadUploadTemp/ -type f -name '*.tmp' -o -name '*.aspx'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild (CISA KEV), immediately upgrade Telerik UI to R2 2017 SP2 or apply the web.config encryption key hardening.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-11357) exists in the RadAsyncUpload component of Progress Telerik UI for ASP.NET AJAX due to insufficient input validation and insecure direct object references (IDOR). When handling file uploads, the component serializes metadata exchanged between the client and server. Because this metadata lacks proper integrity verification and encryption in vulnerable versions, attackers can manipulate the upload parameters.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP POST request to the RadAsyncUpload handler (Telerik.Web.UI.WebResource.axd). This request contains manipulated metadata specifying the target directory and file name. Since the vulnerable Telerik UI does not properly validate the integrity of these parameters, the attacker can bypass file type restrictions and directory traversal protections. This allows them to upload an arbitrary .aspx webshell file directly into the web root or bin directory and execute arbitrary OS commands by requesting the uploaded file.

3. Infrastructure & Business Impact

Classified with a CVSS score of 9.8 (Critical) and listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is actively exploited in the wild. Successful exploitation grants the attacker full control over the web application server, potentially leading to lateral movement within the internal network, sensitive database exfiltration, ransomware deployment, and complete business disruption.

Official Vendor Advisories & References

NVD Original English Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

Source: cve@mitre.org · Mitigation, Vendor Advisory

https://www.exploit-db.com/exploits/43874/

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

https://www.exploit-db.com/exploits/43874/

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2017-11357)

FAQ

Q1. How critical is CVE-2017-11357 and is it actively exploited in the wild?

CVE-2017-11357 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 77.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2017-11357?

Primary impacted vendors include progress, telerik across telerik_ui_for_asp.net_ajax. Scope summary: All versions of Progress Telerik UI for ASP.NET AJAX prior to R2 2017 SP2 (version 2017.2.711)

Q3. What temporary mitigations or workarounds exist for CVE-2017-11357 before patching?

[Mitigation] Immediately upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later, or apply workarounds by disabling RadAsyncUpload and hardening encryption keys Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION