CVE-2017-11317
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
Published Aug 23, 2017 · updated Jun 16, 2026 · telerik ui for asp.net ajax
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Timeline
Detection, updates, and resolution for this record.
Aug 23, 2017 · Catalog
Detected
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Apr 11, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 2, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Required action
Apply updates per vendor instructions.
CISA due date May 2, 2022
Affected
- cpe telerik/ui for asp.net ajaxversion unspecified
- cpe telerik/ui for asp.net ajax2017.2.503
- cpe telerik/ui for asp.net ajax2017.2.621
- vendor Telerik User Interface (UI) for ASP.NET AJAXversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2017-11317
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
cisa.gov - CVE.orgVulnerability recordCVE-2017-11317
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2017-11317
30-day exploitation probability 84.2%
first.org - Exploit DatabasePublic exploit reference43874
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_windows/http/telerik_rau_deserialization
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2017-11317
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
Packet Storm link already published on the finding.
packetstormsecurity.com