CVE-2017-11357: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

CVE-2017-11357 is an insecure direct object reference vulnerability in Telerik UI for ASP.NET AJAX, specifically affecting the RadAsyncUpload component. It can allow unauthorized file uploads to a limited location and, in some cases, remote code execution. This matters because the component is commonly embedded in ASP.NET web applications; successful abuse can give an attacker a foothold on the web server. The vulnerability has been associated with ransomware activity, so organizations still running the affected software should treat it as a high-priority remediation item and confirm all details against the vendor advisory.

How it works

The underlying weakness is classified as CWE-20 (improper input validation). In this case it manifests as an insecure direct object reference in RadAsyncUpload. An attacker who can reach the upload endpoint may supply crafted requests that bypass intended access controls on the object or path being referenced. The result, according to the CISA summary, is the ability to place files in a constrained location on the server and, under certain conditions, achieve remote code execution. Exact request formats, parameters, and preconditions are not detailed here; defenders should treat any unauthenticated or weakly authenticated access to RadAsyncUpload as a potential abuse vector and validate the precise mechanics against the vendor advisory.

Am I affected? How to find it in your systems

Telerik UI for ASP.NET AJAX is a commercial control suite used to build interactive web interfaces. It typically appears in custom or third-party ASP.NET applications hosted on Windows servers running IIS. Inventory steps include:

• Searching source repositories, package manifests, and deployed bin directories for Telerik.Web.UI assemblies or references to RadAsyncUpload.
• Reviewing web.config and application configuration for Telerik upload handlers or related HTTP modules.
• Examining running web applications for the presence of Telerik script or resource handlers.

Because specific vulnerable version ranges are not supplied in the available facts, compare every discovered instance against the vendor advisory to determine whether it is affected. Telemetry that may indicate exploitation includes unexpected file writes under the application’s upload or temporary directories, anomalous POSTs to RadAsyncUpload endpoints, and subsequent process creation or web-shell activity originating from the application pool identity. Correlate these signals with web-server and application logs.

How to remediate

The primary action is to apply the updates published by the vendor, as directed by CISA: “Apply updates per vendor instructions.” After patching, verify that the RadAsyncUpload component (or the entire Telerik UI suite) has been replaced with a fixed build. Additional hardening steps appropriate to this class of flaw include:

• Restricting the upload handler to authenticated and authorized users only.
• Enforcing strict allow-lists for file types, sizes, and destination paths.
• Running the application pool under a least-privilege identity that cannot write outside designated directories.
• Removing or disabling RadAsyncUpload entirely if the feature is not required.

Confirm the exact patch package and any configuration changes with the vendor advisory before deployment.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation or firewall rules that limit access to the affected web applications to trusted networks or authenticated reverse proxies.
• Web-application firewall (WAF) or virtual-patching rules that block anomalous requests to RadAsyncUpload endpoints; tune these carefully to avoid breaking legitimate uploads.
• Temporary disablement of the RadAsyncUpload feature if business requirements allow.
• Heightened monitoring of file-system changes under the web root, process creation by the application pool, and outbound connections from the web server.

These measures lower risk but do not eliminate it; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities of this type have been used in ransomware campaigns and can lead to full server compromise and data theft. If you discover evidence of exploitation or cannot rule out prior exposure, treat the incident as a potential breach: isolate affected hosts, preserve logs, and follow your incident-response plan. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or other personal information have already appeared in public dumps.