Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jul 3, 2017 · Catalog

   Detected

   Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Affected

• cpe progress/sitefinityversion unspecified
• cpe telerik/ui for asp.net ajaxversion unspecified
• vendor Progress ASP.NET AJAX and Sitefinityversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2017-9248

  Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

  cisa.gov
• CVE.orgVulnerability recordCVE-2017-9248

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2017-9248

  30-day exploitation probability 75.1%

  first.org
• Exploit DatabasePublic exploit reference43873

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2017-9248

  Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection

  nvd.nist.gov

References

• Broken Link · securityfocus.com
• Vendor Advisory · telerik.com
• Mitigation · telerik.com
• CISA note · nvd.nist.gov
• Exploit · exploit-db.com