CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

CVE-2017-9248 is a cryptographic weakness in Progress Telerik UI for ASP.NET AJAX and Sitefinity, specifically in Telerik.Web.UI.dll. An attacker who can exploit it may disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), carry out cross-site scripting (XSS), compromise ASP.NET ViewState, and upload or download files. For teams running these components on internet-facing or internal web applications, the issue matters because key disclosure and file access can lead to broader application compromise. Confirm exact product scope and fixed builds against the vendor advisory.

How it works

The weakness is classed as CWE-522 (insufficiently protected credentials). In this product family, cryptographic material used to protect dialog parameters and related ASP.NET mechanisms is inadequately safeguarded inside Telerik.Web.UI.dll. An attacker who can interact with the affected UI endpoints may obtain the DialogParametersEncryptionKey and/or the MachineKey. With those secrets, the attacker can forge or decrypt protected values, inject script (XSS), tamper with ViewState, and perform unauthorized file upload or download through the component’s dialog and handler functionality. Public detail on exact request sequences is limited; treat any unauthenticated or weakly authenticated access to Telerik handlers as high risk and validate behavior only against the vendor’s description.

Am I affected? How to find it in your systems

Progress Telerik UI for ASP.NET AJAX commonly appears in custom .NET web applications; Sitefinity is a full CMS that embeds the same UI stack. Both typically run on IIS under ASP.NET.

• Inventory: Search servers and source repositories for Telerik.Web.UI.dll, references to Telerik.Web.UI, RadEditor/RadDialog, or Sitefinity installations. Check web.config and application pools for Telerik handler mappings (for example, dialog and file-browser endpoints).
• Version and configuration: Identify the assembly version of Telerik.Web.UI.dll and any configured DialogParametersEncryptionKey or machineKey values. Compare them to the fixed versions and guidance in the vendor advisory—do not rely on version numbers from secondary sources.
• Telemetry: Review IIS and application logs for unusual requests to Telerik dialog, upload, or handler paths; unexpected file writes under the web root; ViewState MAC validation failures; or anomalous script execution in administrative or content-editing pages. Network monitoring for repeated access to those endpoints from untrusted sources can also surface reconnaissance or exploitation attempts.

How to remediate

Patch first. Apply the updates Progress supplies for Telerik UI for ASP.NET AJAX and for Sitefinity exactly as described in the vendor advisory and in CISA’s direction to apply updates per vendor instructions. After patching:

• Rotate any keys that may have been exposed (DialogParametersEncryptionKey and the ASP.NET machineKey) and restart affected application pools.
• Confirm that custom encryption-key configuration follows current vendor recommendations so keys are not left at weak or default values.
• Re-scan the application for residual Telerik handlers that are no longer required and remove or restrict them.
• Validate that ViewState MAC validation and other ASP.NET integrity controls remain enabled.

If you can't patch immediately

Reduce exposure until the vendor update can be deployed:

• Segment: Place applications that embed Telerik UI or Sitefinity behind strict network controls so only trusted management networks can reach the administrative and dialog endpoints.
• Virtual patching / WAF: Deploy rules that block or challenge requests to known Telerik dialog, upload, and handler paths; tune to avoid breaking legitimate editors while denying anonymous access.
• Disable or lock down the affected feature: Turn off unused rich-text editors, file browsers, and dialog handlers; require strong authentication and authorization for any that must remain.
• Monitoring: Alert on access to Telerik-related URLs, file-system changes under content directories, and ViewState or cryptographic errors. Retain logs for incident review.
• Key hygiene: If operationally feasible, regenerate machineKey and DialogParametersEncryptionKey values even before patching, accepting that this may invalidate existing sessions or encrypted state.

If your data may have been exposed

Actively exploited cryptographic and file-access flaws can lead to web-shell placement, data theft, or further lateral movement. If you have evidence of exploitation or cannot rule it out, follow your incident-response process: isolate hosts, preserve logs, rotate secrets, and assess uploaded files and content stores for tampering. Ransomware use is not documented for this CVE. As a routine check, you can run a free exposure scan of your email addresses against known breach data to see whether credentials or personal information have appeared in prior incidents.