Vulnerability-Lookup

CNVD-2017-13831

Vulnerability from cnvd - Published: 2017-07-11

Title

ASP.NET AJAX和Sitefinity Progress Telerik UI存在多个漏洞

Description

ASP.NET AJAX是一个用于ASP.NET的控件；Sitefinity是一个开源的用于构建企业网站以及企业内部网络的平台。Progress Telerik UI是美国Telerik公司开发的一个用于处理AJAX的ASP.NET控件的UI（用户界面）。 ASP.NET AJAX R2 2017 SP1之前的版本和Sitefinity 10.0.6412.0之前的版本中的Progress Telerik UI的Telerik.Web.UI.dll存在安全漏洞，该漏洞源于程序未能正确的保护Telerik.Web.UI.DialogParametersEncryptionKey或MachineKey。远程攻击者可利用该漏洞破坏加密保护机制，泄露MachineKey、上传或下载任意文件、实施跨站脚本攻击或控制ASP.NET ViewState。

Severity

高

Patch Name

ASP.NET AJAX和Sitefinity Progress Telerik UI存在多个漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness

Reference

http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity

Impacted products

Name
['Telerik ASP.NET AJAX <R2 2017 SP1', 'Telerik Sitefinity <10.0.6412.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-9248",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9248"
    }
  },
  "description": "ASP.NET AJAX\u662f\u4e00\u4e2a\u7528\u4e8eASP.NET\u7684\u63a7\u4ef6\uff1bSitefinity\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u6784\u5efa\u4f01\u4e1a\u7f51\u7ad9\u4ee5\u53ca\u4f01\u4e1a\u5185\u90e8\u7f51\u7edc\u7684\u5e73\u53f0\u3002Progress Telerik UI\u662f\u7f8e\u56fdTelerik\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u4e2a\u7528\u4e8e\u5904\u7406AJAX\u7684ASP.NET\u63a7\u4ef6\u7684UI\uff08\u7528\u6237\u754c\u9762\uff09\u3002\r\n\r\nASP.NET AJAX R2 2017 SP1\u4e4b\u524d\u7684\u7248\u672c\u548cSitefinity 10.0.6412.0\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Progress Telerik UI\u7684Telerik.Web.UI.dll\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u4fdd\u62a4Telerik.Web.UI.DialogParametersEncryptionKey\u6216MachineKey\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7834\u574f\u52a0\u5bc6\u4fdd\u62a4\u673a\u5236\uff0c\u6cc4\u9732MachineKey\u3001\u4e0a\u4f20\u6216\u4e0b\u8f7d\u4efb\u610f\u6587\u4ef6\u3001\u5b9e\u65bd\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u6216\u63a7\u5236ASP.NET ViewState\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-13831",
  "openTime": "2017-07-11",
  "patchDescription": "ASP.NET AJAX\u662f\u4e00\u4e2a\u7528\u4e8eASP.NET\u7684\u63a7\u4ef6\uff1bSitefinity\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u6784\u5efa\u4f01\u4e1a\u7f51\u7ad9\u4ee5\u53ca\u4f01\u4e1a\u5185\u90e8\u7f51\u7edc\u7684\u5e73\u53f0\u3002Progress Telerik UI\u662f\u7f8e\u56fdTelerik\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u4e2a\u7528\u4e8e\u5904\u7406AJAX\u7684ASP.NET\u63a7\u4ef6\u7684UI\uff08\u7528\u6237\u754c\u9762\uff09\u3002\r\n\r\nASP.NET AJAX R2 2017 SP1\u4e4b\u524d\u7684\u7248\u672c\u548cSitefinity 10.0.6412.0\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Progress Telerik UI\u7684Telerik.Web.UI.dll\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u4fdd\u62a4Telerik.Web.UI.DialogParametersEncryptionKey\u6216MachineKey\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7834\u574f\u52a0\u5bc6\u4fdd\u62a4\u673a\u5236\uff0c\u6cc4\u9732MachineKey\u3001\u4e0a\u4f20\u6216\u4e0b\u8f7d\u4efb\u610f\u6587\u4ef6\u3001\u5b9e\u65bd\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u6216\u63a7\u5236ASP.NET ViewState\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ASP.NET AJAX\u548cSitefinity Progress Telerik UI\u5b58\u5728\u591a\u4e2a\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Telerik ASP.NET AJAX \u003cR2 2017 SP1",
      "Telerik Sitefinity \u003c10.0.6412.0"
    ]
  },
  "referenceLink": "http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity",
  "serverity": "\u9ad8",
  "submitTime": "2017-07-07",
  "title": "ASP.NET AJAX\u548cSitefinity Progress Telerik UI\u5b58\u5728\u591a\u4e2a\u6f0f\u6d1e"
}

CVE-2017-9248 (GCVE-0-2017-9248)

Vulnerability from cvelistv5 – Published: 2017-07-03 19:00 – Updated: 2025-10-21 23:55

Summary

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-07 14:09 UTC

CWE

n/a
CWE-522 - Insufficiently Protected Credentials

Assigner

mitre mitre root Scorecard

References

5 references

URL	Tags
http://www.telerik.com/support/kb/aspnet-ajax/det…	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/43873/	exploitx_refsource_EXPLOIT-DB
http://www.telerik.com/blogs/security-alert-for-t…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/99965	vdb-entryx_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Date Public

2017-07-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:02:43.945Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness"
          },
          {
            "name": "43873",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/43873/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity"
          },
          {
            "name": "99965",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99965"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2017-9248",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T14:09:07.956325Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-522",
                "description": "CWE-522 Insufficiently Protected Credentials",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:55:39.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00.000Z",
            "value": "CVE-2017-9248 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-27T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness"
        },
        {
          "name": "43873",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/43873/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity"
        },
        {
          "name": "99965",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99965"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-9248",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness",
              "refsource": "CONFIRM",
              "url": "http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness"
            },
            {
              "name": "43873",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/43873/"
            },
            {
              "name": "http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity",
              "refsource": "CONFIRM",
              "url": "http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity"
            },
            {
              "name": "99965",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99965"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-9248",
    "datePublished": "2017-07-03T19:00:00.000Z",
    "dateReserved": "2017-05-28T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:55:39.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-13831

CVE-2017-9248 (GCVE-0-2017-9248)

Tags

Sightings

Nomenclature

Related by attack behaviour