CVE-2017-11317: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

CVE-2017-11317 is a vulnerability in Progress Telerik UI for ASP.NET AJAX (specifically the Telerik.Web.UI component) that allows remote attackers to perform arbitrary file uploads or execute arbitrary code. For organizations running ASP.NET applications that embed this UI library, successful abuse can lead to web shell deployment, further lateral movement, or full compromise of the application host. Confirm exact impact and fixed builds against the vendor advisory.

CISA lists the required action as applying updates per vendor instructions. Ransomware use is not documented for this CVE in the provided facts.

How it works

The reported weakness is tracked as CWE-326 (Inadequate Encryption Strength). In this product class, that class of flaw commonly appears when cryptographic protections around upload or handler endpoints are weak or improperly applied, allowing an unauthenticated or low-privilege remote attacker to bypass intended controls.

According to the CISA summary, an attacker can abuse the vulnerable Telerik.Web.UI functionality to upload arbitrary files or achieve arbitrary code execution on the server. Exact request formats, encryption bypass steps, or payload construction are not detailed here; treat any public proof-of-concept material with caution and validate behavior only in a controlled lab against the vendor’s technical description. The practical outcome for defenders is that a reachable ASP.NET application using the affected component may accept attacker-controlled content that the application then treats as executable or persistent.

Am I affected? How to find it in your systems

Telerik UI for ASP.NET AJAX is typically embedded in custom or third-party ASP.NET web applications, often visible as references to Telerik.Web.UI assemblies, RadEditor/RadAsyncUpload controls, or related HTTP handlers in web.config.

• Inventory: Search source repositories, deployment packages, and server file systems for Telerik.Web.UI.dll or NuGet/package references to Telerik UI for ASP.NET AJAX. Check application dependency manifests and binary version resources.
• Configuration: Review web.config for Telerik upload handlers, encryption keys, or async upload endpoints. Note any publicly reachable paths that accept file uploads.
• Runtime: On IIS hosts, enumerate application pools and sites; use assembly-binding logs or module lists to confirm the component is loaded.
• Versions: The facts do not list specific affected version ranges. Compare every discovered build against the vendor advisory to determine whether it is patched.
• Telemetry: Look for anomalous POST traffic to Telerik-related handlers, unexpected file writes under the web root or upload directories, new .aspx/.ashx/.dll files, or process creation spawned by the w3wp.exe worker process. Correlate with web logs showing unusual User-Agent strings or high-entropy filenames.

How to remediate

Patch first. Apply the updates supplied by Progress/Telerik for UI for ASP.NET AJAX exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; do not rely on partial workarounds as a substitute for the official fix.

• After patching, regenerate or rotate any encryption keys or machine keys that the component uses, following vendor guidance, so previously captured material cannot be reused.
• Remove or disable unused Telerik upload features and handlers.
• Enforce least-privilege identities for the application pool, restrict write permissions on directories the worker process can reach, and ensure uploaded content is stored outside the web root and never executed.
• Re-scan the application and its dependencies to confirm the vulnerable assembly is no longer present.

If you can't patch immediately

Implement compensating controls while you schedule the vendor update:

• Network segmentation: Restrict access to the affected application to trusted networks or authenticated reverse proxies; block direct internet exposure of admin or upload endpoints where feasible.
• Virtual patching / WAF: Deploy rules that inspect and block anomalous requests to known Telerik handler paths or that reject unexpected multipart uploads. Tune carefully to avoid breaking legitimate functionality; confirm rule efficacy against the vendor’s description of the flaw.
• Feature disablement: If the application does not require the vulnerable upload functionality, disable the corresponding handlers and controls in configuration.
• Monitoring: Increase logging verbosity on the web server and application; alert on file-creation events in web-accessible directories, unexpected assembly loads, and outbound connections from the IIS worker process. Retain logs for forensic review.
• Hardening: Run the site with a low-privilege identity, enable application pool isolation, and apply file-integrity monitoring on critical paths.

These measures reduce risk but do not eliminate it; prioritize the official patch.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently precede broader compromise, including web-shell placement and data theft. If you have evidence of exploitation or cannot rule it out, follow your incident-response process: isolate affected hosts, preserve volatile evidence, rotate credentials and secrets accessible to the application, and assess what data the application could reach. You can run a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts appear in prior breaches, then force password resets and enable multi-factor authentication where applicable.