Description

The Telerik UI component for ASP.NET AJAX (versions 2019.3.917 and older) is deserializing JSON objects in an insecure manner that results in arbitrary remote code execution on the software's underlying host.

It was not confirmed that remote code execution is possible, this alert was issued based on the version of the Telerik UI component.

Remediation

Upgrade to the latest version: R1 2020 (2020.1.114) and later.

References

Allows JavaScriptSerializer Deserialization

CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI

Telerik UI for ASP.NET AJAX Release History

Telerik RadAsyncUpload Security Documentation

Related Vulnerabilities

WordPress Plugin Divi Builder PHP Code Injection (4.0.9)

WordPress Plugin Plainview Activity Monitor Remote Command Execution (20161228)

VMware vCenter Log4Shell RCE

WordPress Plugin File Manager Remote Code Execution (4.5)

Apache Log4j2 JNDI Remote Code Execution (delayed)

Severity

High

Classification

CVE-2019-18935 CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Insecure Deserialization