Vulnerability Details : CVE-2019-18935
Public exploit exists!
Used for ransomware!
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Vulnerability category: Execute code
Products affected by CVE-2019-18935
- Telerik » Ui For Asp.net AjaxVersions from including (>=) 2011.1.315 and up to, including, (<=) 2020.1.114cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
CVE-2019-18935 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2019-18935
Added on
2021-11-03
Action due date
2022-05-03
Exploit prediction scoring system (EPSS) score for CVE-2019-18935
93.47%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2019-18935
-
Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization
Disclosure Date: 2019-12-09First seen: 2020-10-20exploit/windows/http/telerik_rau_deserializationThis module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through t
CVSS scores for CVE-2019-18935
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-04 |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2019-18935
-
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2019-18935
-
https://www.telerik.com/support/whats-new/release-history
Release History for Telerik ProductsRelease Notes;Vendor Advisory
-
https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
code white | Blog: Telerik RevisitedNot Applicable
-
https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
Allows JavaScriptSerializer Deserialization - Telerik UI for ASP.NET AJAX - KBPatch;Vendor Advisory
-
http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://github.com/noperator/CVE-2019-18935
GitHub - noperator/CVE-2019-18935: RCE exploit for a .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX.Exploit;Third Party Advisory
-
https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29
Telerik UI for ASP.NET AJAX - UI for ASP.NET AJAX R1 2020 (version 2020.1.114)Release Notes
-
http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
Telerik UI Remote Code Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
https://github.com/bao7uo/RAU_crypto
GitHub - bao7uo/RAU_crypto: Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)Exploit;Third Party Advisory
-
https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/
US federal agency hacked using old Telerik bug to steal dataPress/Media Coverage
-
https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UIExploit;Third Party Advisory
-
https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)
Telerik UI for ASP.NET AJAX - UI for ASP.NET AJAX R1 2020 (version 2020.1.114)
Jump to