Other nomination

Remote Code Execution via Insecure Deserialization in Telerik UI

Caleb Gross

Telerik UI for ASP.NET AJAX takes the object type from its encrypted rauPostData upload parameter and hands it to JavaScriptSerializer. After breaking the hard-coded upload encryption key and uploading a mixed mode assembly DLL, an attacker names AssemblyInstaller as the type and points its Path at that DLL, so loading it runs native code and returns a reverse shell.

Record

Researcher

Caleb Gross

Format

Advisory

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Research code
• Original file-upload disclosure

Tags

• deserialization
• rce
• file-upload
• gadget-chain
• aspnet
• dotnet
• attack-chain
• cve
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Caleb Gross, first published at the original source. Preserved copies are kept so the citation survives its host.