Telerik UI RadAsyncUpload Deserialization

aka CVE-2017-11317 (prerequisite)

Product: Progress Telerik UI for ASP.NET AJAX
CVE: CVE-2019-18935
Disclosed: 2019-12-11
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: through 2019.3.1023 (requires known encryption keys, e.g. pre-2017.2.711 hardcoded keys)
Fixed: 2020.1.114 (R1 2020)

Summary

The RadAsyncUpload handler in Telerik's ASP.NET AJAX controls deserializes a JSON type descriptor with JavaScriptSerializer. Combined with weak/hardcoded encryption keys, unauthenticated attackers upload a mixed-mode DLL and load it; multiple APTs used it against US federal agencies (CISA AA23-074A).

Root cause

Telerik.Web.UI.WebResource.axd?type=rau accepts an encrypted rauPostData blob whose type field is deserialized with JavaScriptSerializer and a type resolver. With the encryption key known (CVE-2017-11317 hardcoded key or leaked machine keys), the attacker first uploads a DLL then specifies System.Configuration.Install.AssemblyInstaller with its path, causing LoadLibrary on the DLL.

Impact

Unauthenticated RCE on IIS servers hosting vulnerable Telerik controls.

Public PoC

python3 CVE-2019-18935.py -v <VERSION> -p payloads/sleep-2019121205271355-x86.dll \
  -u <HOST>/Telerik.Web.UI.WebResource.axd?type=rau

Source: noperator / CVE-2019-18935

Detection

Look for POSTs to Telerik.Web.UI.WebResource.axd?type=rau and new .dll/.tmp files in App_Data/RadUploadTemp or C:\Windows\Temp; w3wp.exe loading DLLs from temp.

Mitigation

Upgrade to R1 2020+, set strong custom Telerik.AsyncUpload.ConfigurationEncryptionKey, and restrict the handler.