Summary
- TantoSec has published a working proof-of-concept that chains a padding-oracle vulnerability in Telerik UI for ASP.NET AJAX to unauthenticated remote code execution.
- Exploitation requires the application to be running in a specific non-default configuration, limiting the exposed population.
- Progress Software patched the vulnerability chain in July — organisations that have applied the patch are protected.
- No confirmed in-the-wild exploitation has been reported at time of writing.
- The public release of a working exploit raises the likelihood of opportunistic scanning and targeted attempts against unpatched instances.
What Has Been Released
Security firm TantoSec has published a proof-of-concept exploit targeting Telerik UI for ASP.NET AJAX. The exploit chain begins with an AES-CBC padding-oracle vulnerability — a class of cryptographic weakness that allows an attacker to decrypt or manipulate ciphertext without knowing the encryption key. TantoSec has demonstrated that this weakness can be chained to achieve unauthenticated remote code execution against affected applications.
How the Chain Works
Padding-oracle attacks exploit the way certain cryptographic implementations handle decryption errors. When a system reveals whether a decryption attempt produced valid padding — even through subtle differences in response behaviour — an attacker can iteratively manipulate ciphertext blocks to recover plaintext or forge valid ciphertext. In this case, the vulnerability in Telerik UI’s AES-CBC implementation provides that oracle, and TantoSec has shown it can be leveraged as a stepping stone to execute arbitrary code on the server without any prior authentication.
Scope and Configuration Dependency
The exposure here is meaningfully constrained by a configuration requirement. Exploitation is only possible against applications running in a specific non-default configuration. The source material does not detail exactly what that configuration entails, but the implication is clear: organisations running Telerik UI in standard deployments face a reduced risk profile compared to those who have modified relevant settings. That said, it would be unwise to assume your environment is unaffected without verifying configuration state directly.
Patch Status
Progress Software addressed the vulnerability chain in July. Organisations that have applied that patch are protected. There is no indication from the available source material of any bypass or incomplete fix. The patch represents the primary and most reliable mitigation.
Wild Exploitation: None Confirmed, Risk Elevated
At the time of writing, there are no confirmed reports of this vulnerability being actively exploited in the wild. However, the public availability of a working proof-of-concept materially changes the threat calculus. Exploits that previously required specialised knowledge to develop are now accessible to a much broader range of threat actors. Opportunistic scanning for vulnerable instances should be expected, and the window for patching without incident is narrowing.
Context on Telerik UI
Telerik UI for ASP.NET AJAX is a widely used commercial component library for building web applications on the Microsoft ASP.NET stack. Its broad adoption across enterprise and government environments means vulnerabilities in the product have historically attracted significant attention from both researchers and adversaries. Prior Telerik vulnerabilities have been exploited in real-world attacks, which gives added weight to prompt action here.
Why it matters
For CISOs, the release of a functional exploit chain is a forcing function regardless of wild exploitation status. The affected product has enterprise-wide deployment in many organisations, and the combination of unauthenticated access and remote code execution represents a critical-severity risk profile. Configuration dependency provides some natural filtering of the exposed population, but self-assessment without verification is not a control. Organisations should treat this as an active patching priority, audit their Telerik UI configurations, and review web-facing ASP.NET application inventories to confirm patch coverage. The absence of confirmed exploitation today does not guarantee the same tomorrow, particularly with public exploit code now in circulation.
What to do now
- Apply the Progress Software patch released in July for Telerik UI for ASP.NET AJAX if you have not already done so.
- Audit your Telerik UI deployments to identify any instances running non-default configurations that may increase exposure.
- Review your inventory of internet-facing ASP.NET applications to confirm which ones incorporate Telerik UI components.
- Monitor threat intelligence feeds for any emerging reports of in-the-wild exploitation of this vulnerability chain.
- Consider web application firewall rules targeting padding-oracle attack patterns as a defence-in-depth measure while patching is completed.
