CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Vulnerability summary

CVE-2017-9248 is a critical (CVSS 9.8) Insufficiently Protected Credentials vulnerability in Progress ASP.NET AJAX and Sitefinity. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 75.10% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-07-2017
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVProgress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.