Description

The Telerik UI component for ASP.NET AJAX (versions 2019.3.917 and older) is deserializing JSON objects in an insecure manner that results in arbitrary remote code execution on the software's underlying host.

It was not confirmed that remote code execution is possible, this alert was issued based on the version of the Telerik UI component.

Remediation

Upgrade to the latest version: R1 2020 (2020.1.114) and later.

References

Allows JavaScriptSerializer Deserialization

CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI

Telerik UI for ASP.NET AJAX Release History

Telerik RadAsyncUpload Security Documentation

Related Vulnerabilities

WordPress Plugin Broadcast Live Video-Live Streaming:HTML5, WebRTC, HLS, RTSP, RTMP Remote Code Execution (5.5.15)

WordPress Plugin MailPress Remote Code Execution (7.0.2)

WordPress Plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Remote Code Execution (1.5.89)

Apache 2.x version older than 2.2.3

TimThumb WebShot remote code execution

Severity

High

Classification

CVE-2019-18935 CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Insecure Deserialization