A recent security investigation by TantoSec has unveiled a proof-of-concept exploit targeting Telerik UI for ASP.NET AJAX. This exploit leverages an AES-CBC ‘padding oracle’ vulnerability, potentially allowing unauthenticated remote code execution. The flaw poses a threat only under specific non-default configurations. Progress Software addressed these issues with a patch released in July. Despite the patch, there have been no confirmed cases of this exploit being used in real-world attacks.
Vulnerability Details and Exploit Mechanism
The security company, TantoSec, made public an exploit chain that affects Telerik UI for ASP.NET AJAX. This chain can enable unauthorized individuals to execute code on servers hosting susceptible applications. Progress Software resolved these vulnerabilities in July by issuing a patch. The exploit requires a non-standard setup, but the public release includes a comprehensive breakdown and a tool to execute the attack, marking the first time such information has been widely available.
Although the vulnerabilities were known, Progress Software released a fix in version 2026.2.708 on July 8, with the advisory following on July 22. However, on September 7, TantoSec detailed the full method and released a command-line tool, telerik-rau-exploit, along with two payloads. These payloads can either write a web shell to disk or execute entirely in memory.
Impact and Technical Analysis
The affected component, RadAsyncUpload, was vulnerable in versions from 2010.1.309 to 2026.2.519, as indicated by Progress’s advisory. The most critical issue, an unprotected type-resolution flaw identified as CVE-2026-13181, has a CVSS score of 8.1, indicating high severity. The exploit complexity is considered high due to the specific configuration requirements rather than the difficulty of execution once those conditions are met.
The exploit relies on a padding oracle vulnerability (CVE-2026-13182), which arises because the control uses AES-CBC encryption without an integrity check. This allows an attacker to manipulate data and decrypt the upload configuration. The attacker can then specify an arbitrary .NET type, leading to the execution of a DLL from a controlled location. The execution of native code within this DLL occurs upon loading.
Preventative Measures and Recommendations
Progress Software advises updating to Telerik UI for ASP.NET AJAX version 2026.2.708 or higher, which uses authenticated encryption to mitigate the vulnerability chain. For those unable to upgrade immediately, interim security measures include setting customErrors to RemoteOnly or On, disabling the upload handler if not required, and using strong machine keys rather than runtime-generated keys.
To detect potential exploitation, administrators should monitor for unusual behavior, such as the IIS worker process spawning command prompts or unexpected file creations. Despite these precautions, no confirmed exploitations of the 2026 vulnerabilities have been reported. TantoSec first reported the issues to Progress on May 22, and the fixes were implemented by July 8.
