CVE-2019-18935: 
Telerik UI for ASP.NET AJAX vulnerability analysis and mitigation

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability (CVE-2019-18935) in the RadAsyncUpload function. The vulnerability allows remote code execution when encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357. As of version 2020.1.114, a default setting prevents the exploit, while in version 2019.3.1023 a non-default setting can prevent exploitation (NVD, Bishop Fox).

The vulnerability exists in the RadAsyncUpload handler's processing of the rauPostData parameter in file upload requests. The parameter contains both a serialized configuration object and the object's type. When deserializing, the handler uses JavaScriptSerializer.Deserialize() method which calls setter methods for the specified object type. If an attacker controls this type parameter, they can specify a gadget class that enables remote code execution during deserialization. The exploit typically involves first using CVE-2017-11317 to upload a malicious mixed mode assembly DLL, then exploiting CVE-2019-18935 to load and execute that DLL (Bishop Fox, Code White).

Successful exploitation can result in remote code execution on the underlying host in the context of the w3wp.exe process. Attackers can execute arbitrary commands, deploy additional payloads, establish persistence, and potentially gain complete control of the affected system (Telerik KB).

The vulnerability has been actively exploited in the wild. In March 2023, attackers successfully compromised a U.S. federal agency by exploiting this vulnerability to deploy malicious payloads and exfiltrate data. Multiple threat actors, including an APT actor and the cybercriminal group XE Group, have been observed exploiting this vulnerability (Bleeping Computer).

Organizations should upgrade to Telerik UI for ASP.NET AJAX version R1 2020 (2020.1.114) or later, where the AllowedCustomMetaDataTypes security feature is enabled by default. For version 2019.3.1023, organizations should explicitly enable the AllowedCustomMetaDataTypes security setting. Additionally, organizations should ensure proper configuration of encryption keys and implement recommended security settings as detailed in Telerik's RadAsyncUpload security guide (Telerik KB).