Exploited vulnerability · CISA KEV

Is CVE-2017-11357 exploited? Yes: in CISA KEV since 26 Jan 2023

Gociux · Telerik User Interface (UI) for ASP.NET AJAX · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2017-11357, Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 26 Jan 2023, 1982 days after it was published. It is known to be used in ransomware campaigns. It affects Telerik User Interface (UI) for ASP.NET AJAX. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

What to do

1. Check whether you run it. Look for User Interface (UI) for ASP.NET AJAX in your asset inventory, including appliances and cloud images. Stack check lists every exploited Telerik CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 23 Aug 2017.
4. Get told next time. Email alerts when CISA adds a CVE for Telerik.

Other exploited CVEs in User Interface (UI) for ASP.NET AJAX

• CVE-2017-11317: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability (11 Apr 2022)

References

• docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-di
• nvd.nist.gov/vuln/detail/CVE-2017-11357

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in January 2023 · Telerik scorecard · act-now radar.