CVE-2017-11317: Telerik UI for ASP.NET AJAX weak encryption enables arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, KEV listing, public exploits and very high EPSS make this an urgent patch-first issue.

What it is

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption. Because the encryption protecting the async upload handler is inadequate, a remote attacker can bypass upload restrictions and place arbitrary files on the server. This matters because arbitrary file upload on an ASP.NET application commonly leads to remote code execution.

Impact

An attacker gains the ability to upload arbitrary files and, per the description, execute arbitrary code on the affected server. That typically means full compromise of the web application and its host.

Attack surface

The flaw is reachable over the network through the RadAsyncUpload handler; the CVSS vector shows no privileges and no user interaction required. Any internet- or intranet-exposed instance of the affected Telerik UI for ASP.NET AJAX component is in scope.

Exploitation

It is listed in CISA KEV (added 2022-04-11) and has public exploit references, and EPSS is 0.84175 (99.7th percentile), indicating active and highly likely exploitation. No ransomware campaign use is recorded in this data.

What to do

• Upgrade Telerik UI for ASP.NET AJAX to R1 2017 or later, or R2 2017 SP2 or later, per the vendor advisory.
• If immediate upgrade is not possible, apply the vendor's documented mitigation for the unrestricted file upload in RadAsyncUpload.
• Restrict network access to the affected upload endpoint and block untrusted uploads at the perimeter.
• Verify the application's upload directory cannot execute uploaded files (disable script execution, restrict file types).
• Inventory all deployments of the affected component, including third-party and legacy applications that embed it.

Detection

• Monitor web logs for POST requests to RadAsyncUpload handler paths, especially from unexpected sources.
• Alert on newly written files in web-accessible upload directories, particularly executable extensions.
• Look for process creation spawned by the web server process (w3wp.exe) as a sign of post-upload code execution.
• Check for known exploit payload patterns or tooling tied to the public exploit references for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.