CVE-2017-9248

What it actually does

The component fails to adequately safeguard the DialogParametersEncryptionKey and MachineKey values, allowing remote attackers to obtain these keys and bypass cryptographic protections, resulting in arbitrary file operations, XSS, and ViewState tampering.

Why it matters to the business

Organizations running unpatched instances face immediate risk of full application compromise, data theft, and defacement because the flaw has been actively exploited in the wild for years and carries a CISA remediation deadline that has long passed.

How an attack unfolds

Attackers first discover exposed Telerik dialogs, then use known weaknesses to extract or derive the encryption keys, after which they craft malicious payloads that enable file upload, download, cross-site scripting, or ViewState deserialization attacks leading to remote code execution.

How to fix it

Upgrade Progress Telerik UI for ASP.NET AJAX to R2 2017 SP1 or later and Sitefinity to version 10.0.6412.0 or later; rotate all MachineKeys and encryption keys immediately after patching; disable unused Telerik dialogs where possible.

How to confirm the fix worked

Confirm the exact product version meets or exceeds the fixed releases, verify that new keys have been generated and configured, and retest dialog endpoints for proper encryption behavior.

Typical attack path

1. Identify publicly reachable Telerik UI or Sitefinity endpoints
2. Extract or brute-force DialogParametersEncryptionKey or MachineKey values
3. Forge encrypted dialog parameters or ViewState payloads
4. Upload webshells, download sensitive files, or execute arbitrary code

How to detect it

Review web server and application logs for unusual access to Telerik dialog handlers, failed encryption operations, or unexpected file uploads/downloads; search for known exploit patterns involving key extraction or forged ViewState.

• Telerik.Web.UI.DialogParametersEncryptionKey
• MachineKey leak
• arbitrary file upload via Telerik dialog

What your security team should do

• Apply the required upgrades immediately given the long-standing KEV status and active exploitation
• Rotate all cryptographic keys and MachineKeys across affected applications
• Scan for and remove any unauthorized files or modified ViewState artifacts
• Implement network controls to restrict access to Telerik endpoints until remediation is complete