CVE-2019-18935

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 99.7%

Published11 Dec 2019
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Telerik UI For Asp.net Ajax≥ 2011.1.315 ≤ 2020.1.114

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.htmlExploitThird Party AdvisoryVDB Entry
https://codewhitesec.blogspot.com/2019/02/telerik-revisited.htmlNot Applicable
https://github.com/bao7uo/RAU_cryptoExploitThird Party Advisory
https://github.com/noperator/CVE-2019-18935ExploitThird Party Advisory
https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-uiExploitThird Party Advisory
https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/Press/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935US Government Resource
https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserializationPatchVendor Advisory
https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29Release Notes

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-18935 being actively exploited?

Yes. CVE-2019-18935 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021. It has been used in ransomware campaigns.

How severe is CVE-2019-18935?

CVE-2019-18935 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 99.7% probability of exploitation.

Which products are affected by CVE-2019-18935?

Affected products include Telerik UI For Asp.net Ajax.

How do I fix CVE-2019-18935?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-18935 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.