{"id":"CVE-2017-11357","kind":"vulnerability","aliases":["CVE-2017-11357"],"related":[],"title":"Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload,…","description":"Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Telerik UI for ASP.NET AJAX has an insecure direct object reference in its RadAsyncUpload control. An attacker can upload files to a limited location and may be able to run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-01-26T00:00:00+00:00","products":[{"name":"Telerik User Interface (UI) for ASP.NET AJAX","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"progress telerik ui for asp.net ajax","fixed":["2020.1.114"],"affected":"< 2020.1.114","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asp.net","exploited","iis","package","ransomware","telerik","windows"],"not_affected_if":["no-telerik-ui-for-aspnet-ajax"],"how_to_check":null,"fix":"Apply the vendor update per Telerik instructions; CISA's KEV entry says only 'Apply updates per vendor instructions'. Exact fixed version: unknown.","status":"open","published_at":"2017-08-23T17:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:45+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:08:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Telerik instructions; CISA's KEV entry says only 'Apply updates per vendor instructions'. Exact fixed version: unknown.","reach":"internet","impact":"high","summary":"Telerik UI for ASP.NET AJAX has an insecure direct object reference in its RadAsyncUpload control. An attacker can upload files to a limited location and may be able to run code on the server.","category":"package","who_cares":["asp.net","telerik","windows","iis"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker uploads files and may achieve remote code execution on the server","analyst_note":"Find the fixed Telerik UI for ASP.NET AJAX version and the RadAsyncUpload configuration check (Telerik advisory for CVE-2017-11357, linked from the KEV entry).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-telerik-ui-for-aspnet-ajax"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2851,"output_tokens":385,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-11357':21A,24A '-2017':20A,23A '2017':9A 'abl':72B 'action':109C 'ajax':6A,31A,37A,49B,83C 'and/or':103C 'appli':110C 'asp.net':5A,30A,36A,38B,48B,82C 'attack':61B 'cisa':107C 'code':75B,105C 'contain':84C 'control':59B 'cve':19A,22A 'direct':53B,87C 'execut':106C 'exploit':39B 'file':64B,97C 'for':29A,35A 'ii':40B 'input':16A 'insecur':52B,86C 'instruct':114C 'interface':27A 'limit':67B,101C 'locat':68B,102C 'may':70B 'object':54B,88C 'packag':41B 'per':112C 'progress':1A,32A 'proper':13A 'r2':8A 'radasyncupload':18A,58B,92C 'ransomwar':42B 'refer':55B,89C 'remot':104C 'requir':108C 'restrict':14A 'result':95C 'run':74B 'server':78B 'sp2':10A 'telerik':2A,25A,33A,43B,45B,79C 'ui':3A,28A,34A,46B,80C 'updat':111C 'upload':63B,98C 'user':15A,26A 'vendor':113C 'vulner':90C 'window':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-08-23T17:29:00+00:00","kev":{"dateAdded":"2023-01-26","dueDate":"2023-02-16","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-11357","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11357","severity":null,"published_at":"2023-01-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-11357","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11357","severity":null,"published_at":"2017-08-23T17:29:00+00:00","modified_at":"2026-08-14T05:16:54+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}