CVE-2017-9248 PoC — ASP.NET AJAX和Sitefinity Progress Telerik UI 安全漏洞

Source

https://github.com/hlong12042/CVE-2017-9248

Associated Vulnerability

Title:ASP.NET AJAX和Sitefinity Progress Telerik UI 安全漏洞 (CVE-2017-9248)
Description:Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Readme

# CVE-2017-9248 | Telerik ASP.NET AJAX

## Description

Module Text Editor in Telerik UI for ASP.NET AJAX provide feature "File Manager" in URI ``/Telerik.Web.UI.DialogHandler.aspx``.

The full URI with params is

```
/Telerik.Web.UI.DialogHandler.aspx?DialogName=DocumentManager&renderMode=2&Skin=Default&Title=Document%20Manager&dpptn=&isRtl=false&dp=XXX
```

The vulnerability occur in the ``dp`` param. It is an serialized object, containing other param for config the File Manager Box, such as directory, insecure file extension, ...

Because of lost secure in the logic code of the affected versions, there are some way to bruteforce each character of the encryption key.

Briefly, the equation of the encryption is xxx => decode_base64 =>  xor(,key) => decode_base64  => deserialize

When fuzzing the param ``dp``, we can receice 03 different message:

- Invalid length

![alt text](images/image.png)

- Containing non-base64 character

![alt text](images/image-1.png)

- extract_params cannot be using. (XOR is susccessfully)

![alt text](images/image-2.png)

Because XOR is the alg which encrypting each character of the output, we can use it to bruteforce each one of the right key encryption

# Impact

The Vulnerability do not only provide the tree folder of the webroot, the attacker can config the allow file-upload pattern to *.*

At the results, attacker can upload webshell and Remote the victim server.

# Reproducing

Use the python script to automatically bruteforce the encryption key and create the URL to the File Manager box of webroot

![alt text](images/image-3.png)

![alt text](images/image-4.png)

Create a custom folder and upload a webshell aspx onto it and RCE!!!

File Snapshot


 [4.0K]  /data/pocs/5a3f7a429fd253f332be7ed9a6205ef31854c3bc
├── [4.0K]  images
│   ├── [ 20K]  image-1.png
│   ├── [ 13K]  image-2.png
│   ├── [142K]  image-3.png
│   ├── [101K]  image-4.png
│   ├── [ 19K]  image-5.png
│   └── [ 14K]  image.png
├── [1.7K]  README.md
├── [ 16K]  script.py
└── [1.1K]  web.config

1 directory, 9 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!