Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2017-11357 · Published 23/08/2017 · updated 14/08/2026

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/01/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
telerik ui for asp.net ajax progress	`< 2020.1.114`	`2020.1.114`

Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

References

telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference · Mitigation
exploit-db.com/exploits/43874 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2017-11357

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free