Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability (CVE-2019-18935)

What is affected, what to do

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Progress Telerik UI for ASP.NET AJAX lte 2011.1.315..2020.1.114

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every IIS application shipping Telerik.Web.UI.dll, including third-party products such as CMSs, portals and line-of-business apps. Check the file version, e.g. Get-ChildItem -Recurse -Filter Telerik.Web.UI.dll | % { $_.VersionInfo.FileVersion }. Every version up to and including 2019.3.1023 is vulnerable.
   • Patch: Upgrade to Telerik UI for ASP.NET AJAX 2020.1.114 or later, where the default configuration blocks exploitation. Check the Progress vendor advisory for the current release. For embedded third-party products, request a patched build from the vendor.
   • Version 2019.3.1023: Enable the non-default type whitelist for RadAsyncUpload metadata as described in the Telerik documentation (appSettings key Telerik.Upload.AllowedCustomMetaDataTypes). Older versions lack this control and must be upgraded or isolated.
   • Replace keys: Set unique, random, strong values for Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey and Telerik.Web.UI.DialogParametersEncryptionKey in web.config. Exploitation depends on known keys, obtained via CVE-2017-11317, CVE-2017-11357 or default values.
   • Assume compromise: Treat unpatched internet-facing hosts as potentially compromised. Before patching, preserve evidence: IIS logs, C:\Windows\Temp, the application's upload temp folder and a w3wp.exe memory dump. Afterwards rotate the machineKey plus the application's database and service-account credentials.
   • Unpatchable hosts: If upgrading is impossible, pull the host off the internet or block Telerik.Web.UI.WebResource.axd?type=rau at the reverse proxy or WAF.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/reverse proxy: Block POST requests to /Telerik.Web.UI.WebResource.axd with query type=rau where RadAsyncUpload is not required. Otherwise restrict it to authenticated sessions or known source networks. Also inspect rauPostData bodies for type names such as System.Configuration.Install.AssemblyInstaller.
   • Application config: If the upload handler is unused, disable it where the deployed version supports this (appSettings key Telerik.Web.DisableAsyncUploadHandler = true, per Telerik docs). Move the RadAsyncUpload TemporaryFolder outside the webroot.
   • Endpoint hardening: Use WDAC/AppLocker to block DLL loads from C:\Windows\Temp and %TEMP%, and to stop w3wp.exe spawning shells. Add an EDR custom block for the process chain w3wp.exe → cmd.exe/powershell.exe.
   • Least privilege: Run application pools under non-privileged ApplicationPoolIdentity, never LocalSystem or privileged domain accounts. Remove write permissions on the webroot.
   • Segmentation: Place IIS hosts in a DMZ with strict egress filtering. Allow only required flows (typically 1433 to the database tier) and deny direct outbound internet access to break reverse shells and tool staging.
   • IPS: Enable the Snort/Suricata signatures for CVE-2019-18935 / Telerik RadAsyncUpload in your rulesets (ET, Talos) and confirm they run in blocking mode.
3. 03

   Runbook step 3

   Detection rules

   • IIS access logs: Hunt for POST /Telerik.Web.UI.WebResource.axd with type=rau from unusual sources, especially bursts. SPL: index=iis cs_method=POST cs_uri_stem="*Telerik.Web.UI.WebResource.axd" cs_uri_query="*type=rau*" | stats count by c_ip
   • Sysmon EID 7 (ImageLoad): w3wp.exe loading DLLs from C:\Windows\Temp\ or the upload temp folder. Exploit payloads often carry timestamp-style or numeric filenames. Sigma shape: Image|endswith: '\w3wp.exe' AND ImageLoaded|contains: '\Temp\' AND ImageLoaded|endswith: '.dll'
   • Sysmon EID 1 / EDR ancestry: w3wp.exe → cmd.exe/powershell.exe/rundll32.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe")
   • Sysmon EID 11 (FileCreate): New .dll, .aspx or .ashx files written by w3wp.exe into the webroot or temp paths. This indicates webshells or second-stage payloads.
   • Windows Application log: Event ID 1309 (ASP.NET warning) with Telerik.Web.UI or deserialization exceptions close in time to RAU requests suggests attempts with wrong keys. Correlate with Zeek/Suricata telemetry showing new outbound connections from IIS hosts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Progress Software Progress Telerik UI for ASP.NET AJAX

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• telerik.comsupport/whats-new/release-historyRelease notes, Vendor advisory
• codewhitesec.blogspot.com2019/02/telerik-revisited.htmlNot applicable
• telerik.comsupport/kb/aspnet-ajax/details/allows-javascriptserializer-dese…Patch, Vendor advisory
• github.combao7uo/RAU_cryptoExploit, Third-party advisory
• know.bishopfox.comresearch/cve-2019-18935-remote-code-execution-in-telerik-uiExploit, Third-party advisory
• github.comnoperator/CVE-2019-18935Exploit, Third-party advisory
• packetstormsecurity.comfiles/155720/Telerik-UI-Remote-Code-Execution.htmlThird-party advisory, Vulnerability database
• telerik.comsupport/whats-new/aspnet-ajax/release-history/ui-for-asp-net-aj…Release notes
• packetstormsecurity.comfiles/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserializa…Exploit, Third-party advisory, Vulnerability database
• bleepingcomputer.comnews/security/us-federal-agency-hacked-using-old-telerik-bug-to…Press coverage
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935government-resource, US government resource