CVE-2019-18935 PoC — Progress Telerik UI for ASP.NET AJAX 代码问题漏洞

Source

https://github.com/ThanHuuTuan/Telerik_CVE-2019-18935

Associated Vulnerability

Title:Progress Telerik UI for ASP.NET AJAX 代码问题漏洞 (CVE-2019-18935)
Description:Progress Telerik UI for ASP.NET AJAX是一款HTML编辑器。 Progress Telerik UI for ASP.NET AJAX 2019.3.1023及之前版本中的‘RadAsyncUpload’函数存在代码问题漏洞。远程攻击者可借助特制请求利用该漏洞在w3wp.exe进程上下文中执行任意代码。

Description

TelerikUI Vulnerability Scanner (CVE-2019-18935)

Readme

# TelerikUI Python Scanner
(telerik_rce_scan.py)
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/pyimp.JPG"/> 

# Examples
<b>Assess an IP for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t 192.168.44.21

<b>Assess a hostname for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t vulnerable.telerik.net

<b>Assess a CIDR network range for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -r 23.253.4.0/24

<b>Assess a list of targerts</b><br>
$ python3 telerik_rce_scan.py -iL hosts.txt

------------------------------------------------------------------------------------------------------

# TelerikUI NSE Scanner 
(http-telerik-vuln.nse)

# Installation
Download to your nmap scripts directory (/usr/share/nmap/scripts/)

# Update the nmap scripts database
$ nmap --script-updatedb

# Sample execution:
nmap -sT -p443 --script=http-telerik-vuln 23.253.4.115

# Screen:
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/screen.JPG"/> 

## Thanks

[@mwulftange](https://twitter.com/mwulftange) initially [discovered](https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html) this vulnerability. [@bao7uo](https://github.com/bao7uo) wrote all of the logic for [breaking RadAsyncUpload encryption](https://github.com/bao7uo/RAU_crypto), which enabled manipulating the file upload configuration object in `rauPostData` and subsequently exploiting insecure deserialization of that object.  And thanks to Noperator (@BishopFox) from whom I _copped_ this language and the Legal Disclaimer below.  

## Legal Disclaimer

Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

File Snapshot


 [4.0K]  /data/pocs/1dbe44ea0e9917fc9b5a7682c80e979e62149547
├── [5.0K]  http-telerik-vuln.nse
├── [ 70K]  pyimp.JPG
├── [1.9K]  README.md
├── [ 85K]  screen.JPG
├── [ 88K]  sleep-09202002582419-amd64.dll
├── [ 74K]  sleep-09202002582419-x86.dll
└── [6.2K]  telerik_rce_scan.py

0 directories, 7 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!