CVE-2017-11357

RadAsyncUpload is a built-in part of Telerik’s ASP.NET AJAX tools for uploading files. In affected versions, it doesn’t properly control what an attacker can send, which can let them upload dangerous content and potentially run it on your server—kind of like leaving a “package receiving” door unlocked, where the wrong items could be delivered.

This matters if you run an application built with telerik ui for asp.net ajax that includes file upload functionality using RadAsyncUpload. It’s only a risk when the vulnerable upload feature is reachable by an attacker (for example, from the internet) and they can send requests to it (no special access beyond reaching the endpoint).

RED. This flaw is confirmed in the CISA KEV and has been used in ransomware campaigns, so attackers have been actively targeting systems with it. Public exploits exist, making it practical for criminals to weaponize—update as a priority, not later.

1. Confirm exposure

   • Inventory the Telerik components in your app(s): identify any pages/modules that use RadAsyncUpload or any Telerik upload handlers.
   • Determine the exact Telerik UI for ASP.NET AJAX version currently deployed.

2. Check whether you’re affected

   • If you are running “telerik ui for asp.net ajax” prior to the vendor’s fixed release, you should treat it as affected.

3. Remediate (upgrade)

   • Upgrade to the fixed version: telerik ui for asp.net ajax fixed in 2020.1.114 (or later).
   • Plan for a normal application update cycle (test in staging first). If your app relies on specific Telerik behavior, validate the upload workflow after the upgrade.

4. Temporary mitigation (if patching is delayed)

   • Restrict network access so untrusted clients cannot reach the upload endpoints (RadAsyncUpload-related routes/handlers).
   • If you can’t safely restrict by network, disable or gate the upload feature behind internal-only access or strong authentication until the fixed version is installed.
   • After changes, re-test uploads to ensure legitimate users still work.

5. Verify after updating

   • Re-run functional tests for upload and check application behavior for RadAsyncUpload.
   • Monitor logs for unusual upload attempts, unexpected file names/types, and errors around the upload handlers.

6. Due date context

   • CISA KEV remediation due date listed: 2023-02-16. Your priority remains “update immediately” given the RED verdict and KEV status.

Severity is critical (reported CVSS 9.8). The underlying weakness is CWE-434 (improper restriction of user input), specifically that RadAsyncUpload in affected Telerik UI versions does not properly restrict user input, enabling remote attackers to perform arbitrary file uploads or execute arbitrary code. Findings state this is weaponized (public exploit available) and is confirmed in CISA KEV; CISA requires applying vendor updates per instructions. The KEV listing notes use in ransomware campaigns. A vendor fix is available: telerik ui for asp.net ajax is fixed in 2020.1.114. (EPSS was provided as a prediction, but KEV-confirmed exploitation is the deciding factor for urgency.)