BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidescbr.com.au//bsides-canberra-2026//speaker//DH
 VNEW
BEGIN:VTIMEZONE
TZID:Australia/Sydney
BEGIN:STANDARD
DTSTART:20250925T000000
TZNAME:AEST
TZOFFSETFROM:+1000
TZOFFSETTO:+1000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20251005T030000
RDATE:20261004T030000
TZNAME:AEDT
TZOFFSETFROM:+1000
TZOFFSETTO:+1100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20260405T030000
RDATE:20270404T030000
TZNAME:AEST
TZOFFSETFROM:+1100
TZOFFSETTO:+1000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI fo
 r ASP.NET - Marcio Almeida
DTSTART;TZID=Australia/Sydney:20260925T140000
DTEND;TZID=Australia/Sydney:20260925T145500
DTSTAMP:20261022T194523Z
UID:pretalx-bsides-canberra-2026-RHLJ3X@cfp.bsidescbr.com.au
DESCRIPTION:Progress Telerik UI for ASP.NET AJAX ships in thousands of ent
 erprise web applications. Every control in the library protects its server
  communication using AES-CBC encryption with a separately managed HMAC. In
  this talk we look at the flaws in how that design was implemented and wal
 k through the full exploit chain we built against it.\n\nWe independently 
 researched three consecutive releases and confirmed multiple unauthenticat
 ed remote code execution paths. The primary chain needs no credentials\, n
 o session\, and no prior access to the application. The only prerequisite 
 is a custom encryption key in web.config\, which Telerik's own documentati
 on lists as its first recommended security hardening step.\n\nThe chain st
 arts with a padding oracle in the upload handler. We turn that decryption-
 only primitive into a full encryption oracle using a backwards-CBC techniq
 ue combined with JSON parameter pollution. From there\, a predictable defa
 ult HMAC key lets us forge the upload configuration\, and missing type val
 idation on the client state field converts a forged file upload into a she
 ll via the AssemblyInstaller gadget from the .NET standard library. A seco
 nd independent RCE path runs through the RadFilter persistence mechanism\,
  reachable with a single crafted cookie via a TypeNameHandling.Auto deseri
 alisation sink when cookie-based state persistence is enabled in the appli
 cation.\n\nWe also cover patch analysis from the research period\, looking
  at what the vendor shipped\, what they attempted to fix\, and what the un
 derlying design still exposes.\n\nThe talk runs through the complete chain
  end-to-end with live tooling and closes on what a proper fix actually loo
 ks like.\n\n**DISCLAIMER:** The vulnerabilities described in this submissi
 on are currently subject to coordinated disclosure with the vendor. This t
 alk will be presented after the disclosure period has concluded in accorda
 nce with Tanto Security's coordinated disclosure policy.
LOCATION:Main Track
URL:https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/RHLJ3X/
END:VEVENT
END:VCALENDAR