Ethical Hacking News
A critical vulnerability has been disclosed in Telerik UI for ASP.NET AJAX, allowing an unauthenticated attacker to execute remote code on the server hosting a vulnerable application. This article provides a detailed overview of the disclosed vulnerabilities, the exploitation chain, and the implications of this vulnerability on web application security. Summary: A padding oracle bug and unguarded type-resolution flaw in Telerik UI for ASP.NET AJAX allow an unauthenticated attacker to execute remote code on the server. Upgrade to patched version or implement interim steps to mitigate the risk.
The Telerik UI for ASP.NET AJAX padding-oracle bug is a high-severity vulnerability (CVSS score: 8.1) that allows an unauthenticated attacker to execute remote code on the server. The vulnerability involves a padding oracle bug, an unguarded type-resolution flaw, and a predictable default key in the RadAsyncUpload file-upload control. The chain of vulnerabilities begins with a padding oracle bug, which allows an attacker to forge the encrypted upload configuration without knowing the encryption key. The exploitation chain requires a non-default configuration, making it easier for an attacker to exploit the vulnerability. Progress Software recommends upgrading to Telerik UI for ASP.NET AJAX 2026.2.708 or implementing interim steps to mitigate the risk. The vulnerability poses a significant risk to web application security, and immediate action is required to upgrade or implement interim steps.
Threat Intelligence Newsletter - September 7, 2026
In a significant vulnerability disclosure, security firm TantoSec has released a working exploit chain targeting vulnerabilities in Telerik UI for ASP.NET AJAX. The disclosed exploits, which are chained together, allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application. This article aims to provide a detailed overview of the disclosed vulnerabilities, the exploitation chain, and the implications of this vulnerability on web application security.
The vulnerabilities in question are related to the RadAsyncUpload file-upload control in Telerik UI for ASP.NET AJAX. According to Progress Software, the vendor of the control, the vulnerabilities, which include a padding oracle bug, an unguarded type-resolution flaw, and a predictable default key, carry a CVSS score of 8.1 ("high"). This indicates a high level of severity, as the vulnerability is capable of allowing an attacker to execute remote code on the server with the privileges of the IIS application pool.
The chain of vulnerabilities begins with a padding oracle bug, which is a type of vulnerability that occurs when an application uses a specific encryption scheme to protect data. In this case, the RadAsyncUpload control uses the AES-CBC encryption scheme, but does not perform an integrity check on the encrypted data. This allows an attacker to tamper with the encrypted data and, by using a specific technique, forge the encrypted upload configuration without ever knowing the encryption key.
Once the attacker has forged the encryption key, they can name an arbitrary .NET type and have the control resolve it without an allowlist. This allows the attacker to deserialize the .NET type into a gadget that loads a DLL from a location the attacker controls. The uploaded DLL is a mixed-mode assembly that runs native code as soon as it loads.
The exploitation chain is further complicated by the fact that the vulnerability requires a non-default configuration. This means that the application must be configured with an explicit, non-default encryption key for the control, which is a setting that Telerik recommends as hardening. However, in this case, the key is predictable, which makes it easier for an attacker to exploit the vulnerability.
In order to exploit the vulnerability, the attacker must render a RadAsyncUpload control whose server-side handler reads the upload result. They must also configure the control with a non-default encryption key. Once these conditions are met, the attacker can use the padding oracle bug to decrypt the encrypted upload configuration and forge the key.
The disclosed vulnerabilities have significant implications for web application security. As the vulnerabilities allow an attacker to execute remote code on the server with the privileges of the IIS application pool, they pose a significant risk to the security and integrity of the application.
To mitigate this risk, Progress Software recommends upgrading to Telerik UI for ASP.NET AJAX 2026.2.708 (2026 Q2 SP1), which replaces the flawed AES-CBC scheme with authenticated encryption and closes the entire chain. For sites that cannot upgrade immediately, Progress points to several interim steps, including setting customErrors to RemoteOnly or On, disabling the upload handler entirely, removing any custom encryption key, and generating strong machine keys manually.
In conclusion, the Telerik UI padding-oracle bug chained to unauthenticated RCE is a significant vulnerability that poses a risk to web application security. The disclosed exploits, which are chained together, allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application. To mitigate this risk, web application administrators must take immediate action to upgrade to a patched version of Telerik UI for ASP.NET AJAX or implement the recommended interim steps.
Related Information:
https://www.ethicalhackingnews.com/articles/Telerik-UI-Padding-Oracle-Bug-Chained-to-Unauthenticated-RCE-A-Comprehensive-Analysis-of-the-Exploitation-Chain-and-Implications-ehn.shtml
https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
https://www.imtr.net/article/telerik-ui-padding-oracle-bug-chained-to-unauthenticated-rce-public-exploit-4b2c
Published: Mon Sep 7 08:56:33 2026 by llama3.2 3B Q4_K_M
