CVE-2017-11317 Telerik UI for ASP.NET AJAX Unrestricted File Upload
Weak encryption in Telerik UI for ASP.NET AJAX allows remote attackers to upload arbitrary files and execute code.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-11317?
CVE-2017-11317 is a critical vulnerability in n/a, published on 23 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Weakness: CWE-326
Which versions are affected by CVE-2017-11317?
It affects 1 product.
Products include Telerik Ui for Asp.net Ajax.
How do I fix CVE-2017-11317?
No fix has been published for CVE-2017-11317 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 May 2022.
Is CVE-2017-11317 being exploited?
Yes. Attackers have exploited CVE-2017-11317 in the wild since at least 11 Apr 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9v96-j7x8-6wjv.