admin/GobyVuls
1
0 Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2026-10-24 17:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

add Progress_Telerik_UI_for_ASP_NET_AJAX_Deserialization_CVE_2019_18935

Browse Source
This commit is contained in:
gaopeng2 committed 2021-07-17 16:18:08 +08:00
1 parent 971289f1e9
commit fefcfe89ef
2 files changed
+9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Telerik-UI/CVE-2019-18935/Progress_Telerik_UI_for_ASP_NET_AJAX_Deserialization_CVE_2019_18935.gif
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.4 MiB

Telerik-UI/CVE-2019-18935/REMAD.md
+9
View File
@@ -0,0 +1,9 @@
# Progress Telerik UI for ASP.NET AJAX Deserialization (CVE-2019-18935)
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
**FOFA query rule**: [app="Progress-Telerik-Sitefinity"](https://fofa.so/result?qbase64=YXBwPSJQcm9ncmVzcy1UZWxlcmlrLVNpdGVmaW5pdHki)
# Demo
![](Progress_Telerik_UI_for_ASP_NET_AJAX_Deserialization_CVE_2019_18935.gif)