CVE-2019-18935

What it actually does

.NET deserialization vulnerability in the RadAsyncUpload function allowing remote code execution when encryption keys are known.

Why it matters to the business

Attackers can fully compromise affected web servers leading to ransomware deployment; high urgency due to active exploitation, ransomware use, and CISA deadline of 2022-05-03.

How an attack unfolds

An attacker first obtains the Telerik encryption keys via CVE-2017-11317 or similar, then crafts a malicious serialized .NET object and submits it through the RadAsyncUpload endpoint to trigger deserialization and execute arbitrary code.

How to fix it

Upgrade to version 2020.1.114 or later where the safe default setting prevents exploitation; alternatively enable the non-default protection setting in supported versions.

How to confirm the fix worked

Verify product version is 2020.1.114+, confirm RadAsyncUpload protection setting is active, and test that unauthenticated deserialization attempts are rejected.

Typical attack path

1. Identify internet-facing Telerik UI for ASP.NET AJAX instance
2. Obtain encryption keys via related key disclosure vulnerabilities
3. Craft malicious serialized payload targeting RadAsyncUpload
4. Deliver payload to trigger unsafe deserialization
5. Execute code for initial access and ransomware deployment

How to detect it

Review web server and application logs for RadAsyncUpload requests containing serialized .NET objects; correlate with known threat actor activity targeting Telerik deserialization.

• /Telerik.Web.UI.WebResource.axd
• RadAsyncUpload
• serialized .NET payload patterns in POST bodies

What your security team should do

• Immediately patch or apply the protective setting due to KEV ransomware status
• Hunt for prior exploitation using available detection guidance
• Rotate encryption keys if prior key disclosure CVEs may have been exploited