AUTHOR: Marin Bratanov
DATE POSTED: August 22, 2017
Security vulnerability: user input is used directly by RadAsyncUpload without modification or validation.
An exploit can result in arbitrary file uploads in a limited location and/or remote code execution.
To ensure your application is not exposed to risk, there are several mitigation paths.The recommended approach is to upgrade to the latest version and follow the steps in the RadAsyncUpload Security article. You can find the other alternatives below.
Update from 8 Sep 2017: You should follow one of these options even if you are not using RadAsyncUpload in your application.
Update from 23 Oct 2019: Information on avoiding the issue through general web.config networking settings was removed because it is not sufficiently safe.
Use a patch for versions between Q1 2011 (2011.1.315) and R2 2017 SP1 (2017.2.621).
If you are on active maintenance, upgrade to R2 2017 SP2 (2017.2.711) or later.
NOTE: The patches are not available on the Telerik NuGet feed.
NOTE: If you are targeting .NET 3.5, review the FIPS Compatibility article, because the encryption issue it describes also pertains to these patches.
The R2 2017 SP2 release brings a fix and the ability to disable uploads for the first time. This fix was ported in the patches.
Download a patched version from your Telerik.com account after the 15th of August 2017. If you downloaded it earlier, download it again, because the file was updated since its original creation. Here is how to get the patch:
This patch brings an added security measure. After applying the patched DLL, you can now disable file uploads through the Telerik handler. To do that, set the Telerik.Web.DisableAsyncUploadHandler key in the appSettings section of your web.config to true. You can then create a custom handler with the desired level of security. If you do that, see the UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler KB article.
NOTE: Due to technical feasibility, the following versions do not have patches for this issue:
The patched version shows "Telerik.Web.UI.Patch" in the File Description under Properties in Windows Explorer:
How to spot a patched version of Telerik.Web.UI.dll:
Source code for building a patched version and protecting the Telerik.Web.UI assembly is available as well. If you downloaded it before the 15th of August 2017, you can download it again, because the file was updated.
The R2 2017 SP2 (2017.2.711) release brings an additional security measure. It allows you to disable file uploads through the Telerik handler. To do that, set the Telerik.Web.DisableAsyncUploadHandler key in the appSettings section of your web.config to true. You can then create a custom handler with the desired level of security. If you do that, see the UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler KB article.
We would like to thank Paul Taylor / Foregenix Ltd and Markus Wulftange of Code White GmbH for assisting with making the information public.