Telerik RadAsyncUpload RCE through forged encrypted upload settings

Telerik RadAsyncUpload RCE through forged encrypted upload settings

RadAsyncUpload, the file-upload component in Telerik UI for ASP.NET AJAX, stored its upload rules in an AES-CBC-encrypted JSON blob returned by the browser. Because the blob was not authenticated, distinguishable decryption and JSON parsing failures created a padding oracle. The researchers used it to change the allowed file extensions, upload a DLL, and execute code as the IIS application pool identity.

• Forging the upload configuration — Invalid PKCS#7 padding raised a cryptographic error, while valid padding followed by malformed JSON reached a parsing error. Repeated queries exposed enough information to recover and modify the configuration without the encryption key. A fixed IV prevented the exploit from replacing the JSON from its first byte, so it kept a genuine prefix and forged only the suffix. The suffix added a second AllowedFileExtensions field, and JavaScriptSerializer accepted its final value, allowing DLL uploads.

• Turning the upload into code execution — The upload metadata let the client select the .NET type used to process the result. The exploit set AsyncUploadTypeName to System.Configuration.Install.AssemblyInstaller and pointed Path to the uploaded DLL. When the application read UploadResult, Telerik instantiated the selected class and loaded the file through Assembly.LoadFrom. Windows then invoked DllMain, executing the payload.

The chain requires an exposed page containing RadAsyncUpload, an explicit Telerik.AsyncUpload.ConfigurationEncryptionKey, and a server-side upload handler that reads UploadResult. Progress lists versions 2010.1.309 through 2026.2.519 as affected and fixes the issue in 2026.2.708 by replacing AES-CBC with AES-GCM. The public exploit automates the error-based oracle; the researchers also confirmed a timing oracle when detailed errors are hidden, but have not published that mode.

Article: https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/