CVE-2019-18935 PoC — Progress Telerik UI for ASP.NET AJAX 代码问题漏洞

来源

关联漏洞

Description

TelerikUI Vulnerability Scanner (CVE-2019-18935)

介绍

# TelerikUI Python Scanner
(telerik_rce_scan.py)
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/pyimp.JPG"/> 

# Examples
<b>Assess an IP for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t 192.168.44.21

<b>Assess a hostname for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t vulnerable.telerik.net

<b>Assess a CIDR network range for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -r 23.253.4.0/24

<b>Assess a list of targerts</b><br>
$ python3 telerik_rce_scan.py -iL hosts.txt

------------------------------------------------------------------------------------------------------

# TelerikUI NSE Scanner 
(http-telerik-vuln.nse)

# Installation
Download to your nmap scripts directory (/usr/share/nmap/scripts/)

# Update the nmap scripts database
$ nmap --script-updatedb

# Sample execution:
nmap -sT -p443 --script=http-telerik-vuln 23.253.4.115

# Screen:
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/screen.JPG"/> 

## Thanks

[@mwulftange](https://twitter.com/mwulftange) initially [discovered](https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html) this vulnerability. [@bao7uo](https://github.com/bao7uo) wrote all of the logic for [breaking RadAsyncUpload encryption](https://github.com/bao7uo/RAU_crypto), which enabled manipulating the file upload configuration object in `rauPostData` and subsequently exploiting insecure deserialization of that object.  And thanks to Noperator (@BishopFox) from whom I _copped_ this language and the Legal Disclaimer below.  

## Legal Disclaimer

Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

文件快照

 [4.0K]  /data/pocs/1dbe44ea0e9917fc9b5a7682c80e979e62149547
├── [5.0K]  http-telerik-vuln.nse
├── [ 70K]  pyimp.JPG
├── [1.9K]  README.md
├── [ 85K]  screen.JPG
├── [ 88K]  sleep-09202002582419-amd64.dll
├── [ 74K]  sleep-09202002582419-x86.dll
└── [6.2K]  telerik_rce_scan.py

0 directories, 7 files

备注