CVE-2019-18935 PoC — Progress Telerik UI for ASP.NET AJAX 代码问题漏洞

Source

https://github.com/ekkoo-z/CVE-2019-18935-bypasswaf

Associated Vulnerability

Title: Progress Telerik UI for ASP.NET AJAX 代码问题漏洞 (CVE-2019-18935)
Description:Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

Readme

# CVE-2019-18935-bypasswaf
修改原项目：https://github.com/noperator/CVE-2019-18935  
1. 攻击恶意payload从cookie中传入  
2. metadata数据以加密接口传入并反序列化
3. 默认代理127.0.0.1:8080
4. 默认攻击负载为哥斯拉内存马 密码：pass key AES_base64加密器
想使用自己的内存马逻辑可参考该项目：  
https://github.com/dust-life/CVE-2019-18935-memShell


使用命令: python CVE-2019-18935.py -v xxxx  -u https://xxxxxx/Telerik.Web.UI.WebResource.axd -f c:\\users\\public  -p gmemShell.dll

提示下图一般为利用成功  
<img width="349" height="268" alt="图片" src="https://github.com/user-attachments/assets/27c1e580-846c-4084-94e0-30588d6a2981" />

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →