CVE-2017-11357 Telerik UI for ASP.NET AJAX Insecure Direct Object Reference

Exploited in the wild Critical 9.8 Published 23 Aug 2017 Updated 14 Aug 2026

Remote attackers can upload arbitrary files and execute code via the RadAsyncUpload control in Progress Telerik UI for ASP.NET AJAX.

Exploited in the wild: Since 26 Jan 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-11357?

CVE-2017-11357 is a critical vulnerability in n/a, published on 23 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Weakness: CWE-434

Which versions are affected by CVE-2017-11357?

It affects 1 product.

Products include Progress Telerik Ui for Asp.net Ajax.

How do I fix CVE-2017-11357?

No fix has been published for CVE-2017-11357 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Feb 2023.

Is CVE-2017-11357 being exploited?

Yes. Attackers have exploited CVE-2017-11357 in the wild since at least 26 Jan 2023, including in ransomware campaigns.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-52hx-8455-4qwv.