CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

CVE-2019-18935 is a deserialization of untrusted data flaw in Progress Telerik UI for ASP.NET AJAX. It can be reached through the RadAsyncUpload component and allows an attacker to achieve code execution on the server under the w3wp.exe process. Because the product is commonly embedded in ASP.NET web applications and the vulnerability has been used in ransomware operations, organizations that host or develop such applications should treat it as a high-priority risk and confirm their exposure against the vendor advisory.

How it works

This issue falls under CWE-502: deserialization of untrusted data. In broad terms, the vulnerable component accepts serialized input that is not adequately validated before it is reconstituted into objects. An attacker who can supply crafted data to the RadAsyncUpload functionality can cause the application to instantiate unexpected types or execute attacker-controlled logic. Successful abuse results in arbitrary code running in the security context of the IIS worker process (w3wp.exe). Exact request formats, serialization gadgets, or payload construction details are not provided here; defenders must obtain those from the vendor advisory and reputable technical analyses rather than relying on incomplete public summaries.

Am I affected? How to find it in your systems

Progress Telerik UI for ASP.NET AJAX is typically present in custom or commercial ASP.NET web applications that use Telerik controls for rich UI features, especially file upload. It runs on Windows servers under IIS.

• Inventory web applications and third-party components for references to Telerik.Web.UI or RadAsyncUpload assemblies, configuration entries, and related script or handler mappings.
• Review software bills of materials, package manifests, and build artifacts for the Telerik UI for ASP.NET AJAX product; compare installed versions and configurations against the fixed releases listed in the vendor advisory.
• Search configuration files and web.config sections for RadAsyncUpload settings or custom handlers that expose the component.
• On running systems, examine loaded modules in w3wp.exe processes and check application directories for the Telerik libraries.
• Telemetry signs of exploitation may include anomalous POST traffic to upload-related endpoints, unexpected child processes spawned by w3wp.exe, or deserialization-related exceptions in application and IIS logs. Correlate these with threat-intelligence indicators only after validating them against current vendor and CISA guidance.

If inventory is incomplete, treat any internet-facing ASP.NET application that may include Telerik controls as potentially affected until proven otherwise.

How to remediate

The primary action is to apply the updates published by Progress for Telerik UI for ASP.NET AJAX, following the vendor’s instructions exactly as required by CISA. After patching:

• Rebuild and redeploy affected applications so that the updated assemblies are loaded.
• Remove or replace any residual older Telerik binaries from bin directories, GAC, and deployment packages.
• Harden deserialization surfaces in general: prefer allow-lists of known-safe types, disable unused formatters, and avoid deserializing data from untrusted sources.
• Ensure the application pool identity runs with least privilege and that file-system and network permissions for the worker process are tightly constrained.
• Re-test upload and related functionality after the update to confirm both remediation and continued business operation.

Confirm the precise fixed versions, upgrade paths, and any configuration changes solely against the official vendor advisory.

If you can't patch immediately

Implement compensating controls while scheduling the official update:

• Network segmentation and strict access control: restrict which clients can reach the affected web applications, preferably limiting them to authenticated internal users or known IP ranges.
• Virtual patching or WAF rules: block or challenge requests that target RadAsyncUpload endpoints or that exhibit characteristics of deserialization attacks; tune rules carefully to avoid breaking legitimate uploads.
• Disable or remove the RadAsyncUpload feature if the business function is not required; substitute a safer upload mechanism where possible.
• Enhanced monitoring: alert on anomalous process creation from w3wp.exe, unusual outbound connections, and spikes in errors related to serialization or file upload handlers.
• Temporary reduction of the attack surface by placing the application behind additional authentication or by taking non-critical instances offline until patched.

These measures reduce risk but do not replace the vendor update.

If your data may have been exposed

Actively exploited vulnerabilities of this class, including those with known ransomware use, frequently lead to full server compromise, data theft, or encryption. If you have evidence of exploitation or cannot rule it out, initiate incident-response procedures: isolate affected hosts, preserve logs and memory, rotate credentials, and assess lateral movement. As a quick personal check, individuals can run a free exposure scan of their email addresses against known breach data sets to determine whether their credentials or personal information already appear in public breach corpora.