CVE-2019-18935·Telerik vulnerability
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
- Severity
- critical
- Software
- Telerik
- Published
How Defensia detected this
Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2019-18935 starting , across 5.3% of the servers Defensia monitors, from 11 distinct attacking IP addresses.
Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.
Where the attacks came from
Aggregated across every server Defensia monitors, over 7 days of observation, last measured . Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 100% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 2011.1.315
Until: 2020.1.114
References
- http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
- https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
- https://github.com/bao7uo/RAU_crypto
- https://github.com/noperator/CVE-2019-18935
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2019-18935. Free for 1 server.
Get started free