Rapid7 Vulnerability & Exploit Database

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization

Back to Search

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization



This module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization flaw. Uploading the file requires knowledge of the cryptographic keys used by RAU. The default values used by this module are related to CVE-2017-11317, which once patched randomizes these keys. It is also necessary to know the version of Telerik UI ASP.NET that is running. This version number is in the format YYYY.#(.###)? where YYYY is the year of the release (e.g. '2020.3.915').


  • Spencer McIntyre
  • Paul Taylor
  • Markus Wulftange
  • Caleb Gross
  • Alvaro Muñoz
  • Oleksandr Mirosh
  • straightblast




x86, x64


Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/telerik_rau_deserialization
msf exploit(telerik_rau_deserialization) > show targets
msf exploit(telerik_rau_deserialization) > set TARGET < target-id >
msf exploit(telerik_rau_deserialization) > show options
    ...show and set options...
msf exploit(telerik_rau_deserialization) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security