CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness

Exploited in the wild Critical 9.8 Published 3 Jul 2017 Updated 21 Oct 2025

Weak cryptographic protection in Telerik UI allows attackers to leak keys, enabling file access, XSS, and ViewState compromise.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-9248?

CVE-2017-9248 is a critical vulnerability in n/a, published on 3 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Weakness: CWE-522

Which versions are affected by CVE-2017-9248?

It affects 2 products.

Products include Progress Sitefinity, Telerik Ui for Asp.net Ajax.

How do I fix CVE-2017-9248?

No fix has been published for CVE-2017-9248 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Is CVE-2017-9248 being exploited?

Yes. Attackers have exploited CVE-2017-9248 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Exploit-DB entry and 7 proofs of concept on GitHub.

Sources

Also known as GHSA-mfqq-q5rf-3hvq.