CVE-2019-18935

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2019-18935 9.8

Progress · Telerik UI for ASP.NET AJAX · Added 2021-11-03 · Published 2019-12-11

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityProgress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

VendorProgress

ProductTelerik UI for ASP.NET AJAX

Date added2021-11-03

Due date2022-05-03

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

NVD: Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-17 12:53 UTC

Wall time0.3s

Searches2

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2019-18935
https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/common-allows-javascriptserializer-deserialization
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
https://github.com/noperator/CVE-2019-18935
https://github.com/bao7uo/RAU_crypto
https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a
https://www.exploit-db.com/exploits/47793
https://www.rapid7.com/db/modules/exploit/windows/http/telerik_rau_deserialization/

Hunting hypothesis agent

Hunt IIS logs for POSTs to /Telerik.Web.UI.WebResource.axd?type=rau; upload replies echo Telerik.Web.UI.UploadedFileInfo JSON and deserialization triggers end in delayed Runtime Error 500s, while rauPostData blobs need WAF/IDS body capture.

Research details

ComponentRadAsyncUpload (RAU) HTTP handler — the Telerik.Web.UI.WebResource.axd?type=rau endpoint

PreconditionsTarget must run Telerik UI for ASP.NET AJAX through 2019.3.1023 with the RadAsyncUpload handler registered in the application's web.config (Telerik.Web.UI.WebResource.axd?type=rau reachable over HTTP/HTTPS), and the attacker must know the Telerik encryption keys — typically the hardcoded default 'PrivateKeyForEncryptionOfRadAsyncUploadConfiguration' on versions before R2 2017 SP1 (CVE-2017-11317) or keys abused via the missing HMAC validation of CVE-2017-11357. No application authentication is required; the attacker uploads a mixed-mode .NET DLL to a writable temp folder and then submits a second rauPostData naming System.Configuration.Install.AssemblyInstaller so JavaScriptSerializer loads the DLL. A default setting blocks the deserialization path from 2020.1.114 (R1 2020). agent

DeliveryTwo-step unauthenticated POST to /Telerik.Web.UI.WebResource.axd?type=rau: an AES-encrypted rauPostData blob first uploads a mixed-mode .NET DLL (replies echo fileInfo/metaData JSON naming the dropped file), then a second rauPostData names System.Configuration.Install.AssemblyInstaller so JavaScriptSerializer loads it in w3wp.exe

Public PoCyes

PoC URLs https://github.com/noperator/CVE-2019-18935
https://github.com/bao7uo/RAU_crypto
https://github.com/murataydemir/CVE-2019-18935
https://www.exploit-db.com/exploits/47793 Third-party repos; verify before use.

Advisoryhttps://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/common-allows-javascriptserializer-deserialization

Exploit notesFully weaponized public chain (RAU_crypto encryption abuse + noperator deserialization exploit with Telerik major-year version brute-forcing and a Sleep/timing success oracle); mass-exploited by APT and ransomware actors per CISA AA23-074A | CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

SummaryTelerik UI for ASP.NET AJAX through 2019.3.1023 lets the RadAsyncUpload handler (Telerik.Web.UI.WebResource.axd?type=rau) deserialize an attacker-chosen .NET type from the encrypted rauPostData parameter; with the Telerik encryption keys (hardcoded default via CVE-2017-11317 or missing HMAC via CVE-2017-11357) an attacker loads a malicious mixed-mode DLL and gains RCE in w3wp.exe. The chain is unauthenticated and has been mass-exploited by APT and ransomware actors (CISA AA23-074A); Progress fixed it in R1 2020 (2020.1.114).

Tia coverage

First reported2026-09-27

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

vulnerability-attack-case-installation-of-a-web-shell-and-execut

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.