CVE-2019-18935

What Is Telerik UI for ASP.NET AJAX?

Telerik UI for ASP.NET AJAX is a commercial component suite from Progress Software that provides pre-built UI controls — grids, upload widgets, editors — for ASP.NET web applications. RadAsyncUpload is one of these controls, handling large file uploads asynchronously. Because Telerik controls are bundled into thousands of custom enterprise and government web applications, a flaw in the shared control library becomes a flaw in every application built on top of it — many of which the deploying organization may not even know contains Telerik code.

Overview

CVE-2019-18935 is a critical .NET deserialization vulnerability in the RadAsyncUpload handler. An attacker who can construct a valid serialized payload can get the ASP.NET worker process (w3wp.exe) to deserialize it, resulting in remote code execution in the context of the web application. It was assigned a CVSS score of 9.8 and has been one of the most persistently exploited web application vulnerabilities of the early 2020s, repeatedly showing up in incident response engagements years after patches were available.

Technical Details

The root cause is CWE-502 (Deserialization of Untrusted Data). RadAsyncUpload uses .NET's JavaScriptSerializer with a type-resolving binder to deserialize state passed by the client. Exploiting this cleanly requires the attacker to know the site's ASP.NET machine key (the validationKey/decryptionKey pair used to sign and encrypt view state and Telerik's serialized blobs). In many real-world compromises, attackers obtained these keys through separate misconfigurations — exposed web.config files, weak or default keys, or leakage through other bugs in the same Telerik component family. Once the keys are known, an attacker can craft a malicious serialized object using a gadget chain (tooling such as ysoserial.net was commonly used) that, once deserialized by the vulnerable handler, executes arbitrary code with the privileges of the IIS application pool.

The attack is unauthenticated and requires only network access to the vulnerable endpoint plus knowledge of the site's machine keys — no user interaction is needed, and a single crafted HTTP request can achieve full code execution.

Discovery

The vulnerability was addressed by Progress through its routine advisory and patch process; RadAsyncUpload deserialization issues in the Telerik UI product line had been a recurring research area for several years prior, with security researchers repeatedly finding new ways to reach the same underlying deserialization sink.

Exploitation Context

CVE-2019-18935 saw sustained, widespread exploitation. CISA's KEV addition (November 2021) confirms active exploitation, but the more notable public data point is CISA's own incident response reporting describing a compromise of a US federal civilian executive branch agency network in which an advanced persistent threat actor exploited an unpatched, internet-facing Telerik UI instance to gain an initial foothold, deploy web shells, and move laterally. The vulnerability has also been used by ransomware affiliates and commodity intrusion sets scanning the internet for exposed Telerik endpoints, since so many organizations are unaware their vendor-supplied applications bundle a vulnerable Telerik version.

Remediation

1. Upgrade Telerik UI for ASP.NET AJAX to the R1 2020 release (2020.1.114) or later, which removes the vulnerable deserialization path.
2. Rotate ASP.NET machine keys (validationKey/decryptionKey) — do not rely on Telerik's default or auto-generated keys, and ensure web.config is never web-accessible.
3. Inventory third-party web applications for bundled Telerik UI controls; many organizations run vulnerable versions unknowingly inside vendor products.
4. Review IIS and web server logs for anomalous POST requests to Telerik.Web.UI.WebResource.axd or upload handler endpoints, and for unexpected files dropped in web-accessible directories (web shells).
5. Restrict internet exposure of legacy or unmaintained ASP.NET applications, and treat any unpatched instance as potentially already compromised given the multi-year exploitation history.