AUTHOR: Marin Bratanov
DATE MODIFIED : November 23, 2017
DATE POSTED: August 22, 2017
Security vulnerability: user input is used directly by RadAsyncUpload without modification or validation.
An exploit can result in arbitrary file uploads in a limited location and/or remote code execution.
To ensure your application is not exposed to risk, there are several mitigation paths. You can find them below.
Update from 8 Sep 2017: You should follow one of these options even if you are not using RadAsyncUpload in your application. Also, we added examples of how to disable file uploads without using a patch.
Prevent POST requests to the handler used by RadAsyncUpload
Use a patch for versions between Q1 2011 (2011.1.315) and R2 2017 SP1 (2017.2.621).
If you are on active maintenance, upgrade to R2 2017 SP2 (2017.2.711) or later.
NOTE: The patches are not available on the Telerik NuGet feed.
NOTE: If you are targeting .NET 3.5, review the FIPS Compatibility article, because the encryption issue it describes also pertains to these patches.
Versions starting from R2 2017 SP2 and the provided patches allow you to set an appSettings key to disable file uploads. If you cannot upgrade or apply a patch, an alternative is to disable the POST requests that upload the file to the built-in Telerik handler from your web.config. Here are two suggestions on how to achieve this:
The R2 2017 SP2 release brings a fix and the ability to disable uploads for the first time. This fix was ported in the patches.
Download a patched version from your Telerik.com account after the 15th of August 2017. If you downloaded it earlier, download it again, because the file was updated since its original creation. Here is how to get the patch:
This patch brings an added security measure. After applying the patched DLL, you can now disable file uploads through the Telerik handler. To do that, set the Telerik.Web.DisableAsyncUploadHandler key in the appSettings section of your web.config to true. You can then create a custom handler with the desired level of security. If you do that, see the UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler KB article.
NOTE: Due to technical feasibility, the following versions do not have patches for this issue:
The patched version shows "Telerik.Web.UI.Patch" in the File Description under Properties in Windows Explorer:
How to spot a patched version of Telerik.Web.UI.dll:
Source code for building a patched version and protecting the Telerik.Web.UI assembly is available as well. If you downloaded it before the 15th of August 2017, you can download it again, because the file was updated.
The R2 2017 SP2 (2017.2.711) release brings an additional security measure. It allows you to disable file uploads through the Telerik handler. To do that, set the Telerik.Web.DisableAsyncUploadHandler key in the appSettings section of your web.config to true. You can then create a custom handler with the desired level of security. If you do that, see the UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler KB article.
We would like to thank Paul Taylor / Foregenix Ltd for assisting with making the information public.