CVE-2017-11357: Telerik UI for ASP.NET AJAX RadAsyncUpload unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a public exploit, KEV listing, ransomware use, and near-maximum EPSS score.

What it is

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 fails to properly restrict user input to the RadAsyncUpload control, allowing arbitrary file uploads. Because uploaded files can be executed, this is a critical remote code execution path in a widely deployed web component.

Impact

An unauthenticated remote attacker can upload arbitrary files and execute arbitrary code on the server, leading to full compromise of the web application and its host.

Attack surface

Reachable over the network through the RadAsyncUpload endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed application using the vulnerable control is directly reachable.

Exploitation

Listed in CISA KEV since 2023-01-26 with known ransomware campaign use, and EPSS 30-day probability is 0.777 (99.5th percentile). A public Exploit-DB entry (43874) exists, so exploitation is active and tooling is available.

What to do

• Upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later; this is the only complete fix.
• If immediate upgrade is impossible, apply the vendor mitigation guidance for RadAsyncUpload insecure direct object reference.
• Restrict or block external access to the RadAsyncUpload handler until patched.
• Ensure uploaded files are stored outside the web root and cannot be executed by the application server.
• Audit for prior compromise, given KEV ransomware association.

Detection

• Monitor web logs for POST requests to RadAsyncUpload handler paths, especially with unusual file extensions or content types.
• Alert on newly created files in web-accessible upload directories, particularly executable extensions.
• Look for outbound connections or child processes spawned by the web server process (w3wp.exe) after upload activity.
• Hunt for known Telerik exploitation patterns and webshell artifacts in upload directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.