Rapid7 Vulnerability & Exploit Database

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization

Back to Search

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization

Disclosed
12/09/2019
Created
10/21/2020

Description

This module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization flaw. Uploading the file requires knowledge of the cryptographic keys used by RAU. The default values used by this module are related to CVE-2017-11317, which once patched randomizes these keys. It is also necessary to know the version of Telerik UI ASP.NET that is running. This version number is in the format YYYY.#(.###)? where YYYY is the year of the release (e.g. '2020.3.915').

Author(s)

  • Spencer McIntyre
  • Paul Taylor
  • Markus Wulftange
  • Caleb Gross
  • Alvaro Muñoz
  • Oleksandr Mirosh
  • straightblast

Platform

Windows

Architectures

x86, x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/telerik_rau_deserialization
msf exploit(telerik_rau_deserialization) > show targets
    ...targets...
msf exploit(telerik_rau_deserialization) > set TARGET < target-id >
msf exploit(telerik_rau_deserialization) > show options
    ...show and set options...
msf exploit(telerik_rau_deserialization) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;