Marcio Almeida
Marcio Almeida is one of the Co-Founders and the Director of Technical Services at Tanto Security. He has worked in cyber security for over 15 years and has experience with Penetration Testing, Code Review, Exploit Development, Secure Development, DevSecOps and Red Team Operations.
Session
Progress Telerik UI for ASP.NET AJAX ships in thousands of enterprise web applications. Every control in the library protects its server communication using AES-CBC encryption with a separately managed HMAC. In this talk we look at the flaws in how that design was implemented and walk through the full exploit chain we built against it.
We independently researched three consecutive releases and confirmed multiple unauthenticated remote code execution paths. The primary chain needs no credentials, no session, and no prior access to the application. The only prerequisite is a custom encryption key in web.config, which Telerik's own documentation lists as its first recommended security hardening step.
The chain starts with a padding oracle in the upload handler. We turn that decryption-only primitive into a full encryption oracle using a backwards-CBC technique combined with JSON parameter pollution. From there, a predictable default HMAC key lets us forge the upload configuration, and missing type validation on the client state field converts a forged file upload into a shell via the AssemblyInstaller gadget from the .NET standard library. A second independent RCE path runs through the RadFilter persistence mechanism, reachable with a single crafted cookie via a TypeNameHandling.Auto deserialisation sink when cookie-based state persistence is enabled in the application.
We also cover patch analysis from the research period, looking at what the vendor shipped, what they attempted to fix, and what the underlying design still exposes.
The talk runs through the complete chain end-to-end with live tooling and closes on what a proper fix actually looks like.
DISCLAIMER: The vulnerabilities described in this submission are currently subject to coordinated disclosure with the vendor. This talk will be presented after the disclosure period has concluded in accordance with Tanto Security's coordinated disclosure policy.