{"id":2724,"date":"2026-09-07T15:44:45","date_gmt":"2026-09-07T15:44:45","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2724"},"modified":"2026-09-07T15:44:45","modified_gmt":"2026-09-07T15:44:45","slug":"telerik-ui-padding-oracle-bug-chained-to-unauthenticated-rce-public-exploit-released","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2724","title":{"rendered":"Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE \u2014 Public Exploit Released"},"content":{"rendered":"
\n
<\/a><\/div>\n

A TantoSec proof-of-concept turns an AES-CBC \u00abpadding oracle\u00bb in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution \u2014 but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.<\/em><\/p>\n

Security firm TantoSec <\/strong>has published a working exploit chain targeting vulnerabilities in Telerik UI<\/strong> for ASP.NET AJAX that can allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application.<\/p>\n

Progress Software patched the flaws in July, and exploitation requires a non-default configuration \u2014 but the release pairs a detailed write-up with a ready-to-run tool and two payloads, putting a complete attack path in public hands for the first time.<\/p>\n

The underlying flaws are not new. Progress shipped the fix in version 2026.2.708 (2026 Q2 SP1) on July 8 and published the CVEs and advisory on July 22.<\/p>\n

What changed on September 7 is the disclosure of the method and the tooling: TantoSec’s Marcio Almeida walked through the full chain<\/a> and released a command-line tool, telerik-rau-exploit, along with two mixed-mode DLL payloads \u2014 one that writes a web shell to disk and one that runs entirely in memory.<\/p>\n

The chain affects the RadAsyncUpload file-upload control in versions 2010.1.309 through 2026.2.519, according to Progress’s advisory<\/a>; 2026.2.708 and later are fixed.<\/p>\n

The most serious of the bugs, an unguarded type-resolution flaw tracked as CVE-2026-13181<\/strong>, carries a CVSS score of 8.1 (\u00abhigh\u00bb); its \u00abhigh\u00bb attack-complexity rating reflects the configuration prerequisites described below rather than any difficulty in exploitation once they are met.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Running an affected version is not enough to be exploitable. TantoSec says the chain has \u00abpreconditions that are not met by a default installation\u00bb: a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must be configured with an explicit, non-default encryption key for the control \u2014 which, in a twist, is a setting Telerik recommends as hardening. Sites on an affected version without both conditions are not exploitable through this chain.<\/p>\n

<\/p>\n

Where those conditions hold, the payoff is code execution with the privileges of the IIS application pool. The entry point is a padding oracle (CVE-2026-13182): because the control encrypts its client-side state with AES-CBC and no integrity check, the server responds differently to tampered data depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON.<\/p>\n

That difference lets an attacker decrypt \u2014 and, with a technique TantoSec built around the control’s fixed encryption seed, forge \u2014 the encrypted upload configuration without ever knowing the key.<\/p>\n

The same forgery allows the attacker to name an arbitrary .NET type, which the control resolves without an allowlist (CVE-2026-13181) and deserializes into a gadget that loads a DLL from a location the attacker controls.<\/p>\n

The uploaded DLL is a mixed-mode assembly that runs native code as soon as it loads. It is not instant: TantoSec’s end-to-end run took roughly 127,000 oracle requests \u2014 about an hour against a lab target, and longer against a rate-limited server.<\/p>\n

If the application hides detailed error messages, the oracle can still be read through response timing, a variant tracked as CVE-2026-13183.<\/p>\n

There are no confirmed reports of the 2026 flaws being exploited in the wild, and none appears in CISA’s Known Exploited Vulnerabilities catalog as of September 7.<\/p>\n

One attack-surface-management vendor, IONIX, states on its site<\/a> that it is \u00abtracking ongoing exploitation attempts,\u00bb but it gives no dates, volumes, or other specifics, and does not distinguish exploitation from ordinary internet scanning of the handler.<\/p>\n

The component itself has a long history of real-world attacks \u2014 but through older bugs, not these. A 2019 deserialization flaw in the same handler, CVE-2019-18935<\/a>, was chained with a 2017 encryption weakness and exploited by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited as recently as 2025.<\/p>\n

That track record is why an unauthenticated code-execution path in this handler draws attention, even though the new bugs have no confirmed exploitation.<\/p>\n

Two further points bound the story. Progress’s July bulletin actually covers two separate attack chains: the RadAsyncUpload chain TantoSec detailed, and a distinct remote-code-execution chain in the RadPersistenceManager and RadDockLayout components (CVE-2026-13185, -13186 and -13190), credited to CODE WHITE’s Markus Wulftange and Progress, for which no public exploit has been released.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

And within the RadAsyncUpload chain, a fourth bug involving a predictable default key (CVE-2026-13184) applies only to an alternative attack mode the released demonstration did not use.<\/p>\n

What to do<\/h2>\n

Upgrade to Telerik UI for ASP.NET AJAX 2026.2.708 (2026 Q2 SP1) or later, which replaces the flawed AES-CBC scheme with authenticated encryption and closes the entire chain.<\/p>\n

Progress calls upgrading its only official recommendation and warns that a stronger custom key does not help, because the oracle never needs the key.<\/p>\n

For sites that cannot upgrade immediately, Progress points to several interim steps:<\/p>\n

    \n
  • Set customErrors to RemoteOnly or On, which forces an attacker onto the slower timing-based variant.<\/li>\n
  • Disable the upload handler entirely (Telerik.Web.DisableAsyncUploadHandler set to true) if RadAsyncUpload is not required.<\/li>\n
  • Remove any custom encryption key so the control falls back to the ASP.NET machine key with AES and HMAC, or generate strong machine keys manually rather than at runtime.<\/li>\n<\/ul>\n

    Because Progress warns that successful exploitation \u00ableaves no obvious trace in standard ASP.NET error logs,\u00bb defenders should hunt behaviourally rather than for error signatures: the IIS worker process (w3wp.exe) spawning cmd.exe, a new or unexpected .aspx file in the web root, or a mixed-mode DLL written under the upload control’s temporary folder or App_Data.<\/p>\n

    TantoSec reported the issues to Progress on May 22; the fix shipped on July 8, and the CVEs followed on July 22. Almeida credited colleague Justin Steven for the timing-oracle variant.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    A TantoSec proof-of-concept turns an AES-CBC \u00abpadding oracle\u00bb in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution \u2014 but only against applications in a specific non-default configuration, and…<\/p>\n","protected":false},"author":1,"featured_media":2725,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[610,3331,120,3330,328,316,1024,3329,725],"class_list":["post-2724","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-bug","tag-chained","tag-exploit","tag-paddingoracle","tag-public","tag-rce","tag-released","tag-telerik","tag-unauthenticated"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2724"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2724\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2725"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}