{"id":"CVE-2017-9248","published":"2017-07-03T19:29:00Z","modified":"2026-06-17T01:27:44Z","title":"Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability","vendor":"Progress","product":"ASP.NET AJAX and Sitefinity","tier":"core","eol":null,"description":{"text":"Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.","provenance":"source","from":"NVD"},"summary":{"text":"Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX (before R2 2017 SP1) and Sitefinity (before 10.0.6412.0) fails to adequately protect the Telerik.Web.UI.DialogParametersEncryptionKey and the MachineKey. A remote, unauthenticated attacker who can reach the affected application, with no user interaction required, can defeat the cryptographic protections to leak the MachineKey, upload or download arbitrary files, perform cross-site scripting, or compromise ASP.NET ViewState.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:56Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.75098,"percentile":0.99507,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9248","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-10-22","exploitedFirstSeen":"2020-10-22","ransomware":false,"evidence":[{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-296b","date":"2020-10-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-074a","date":"2023-03-15"},{"url":"https://www.cisa.gov/news-events/analysis-reports/ar23-166a","date":"2023-06-15"},{"url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-074a-Threat%20Actors%20Exploit%20Progress%20Telerik%20Vulnerabilities%20in%20Multiple%20U.S.%20Government%20IIS%20Servers.pdf","date":"2024-06-15"},{"url":"https://www.oipc.bc.ca/documents/investigation-reports/2886","date":"2024-11-25"},{"url":"https://intezer.com/blog/research/xe-group-exploiting-zero-days/","date":"2025-02-03"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"http://www.securityfocus.com/bid/99965","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity","tags":["Vendor Advisory"]},{"url":"http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/43873/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/99965","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity","tags":["Vendor Advisory"]},{"url":"http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/43873/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated attacker exploits public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers","start":112,"end":244}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exposes stored cryptographic keys and secrets","mappingType":"primary_impact","evidence":[{"from":"description","quote":"does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey","start":112,"end":200}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-18184","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-18184","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":43873,"url":"https://www.exploit-db.com/exploits/43873","title":"Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure","type":"webapps","platform":"aspx","date":"2018-01-24","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-01-24"},"pocGithub":{"count":6,"skipped":1,"earliest":"2018-01-16","earliestUrl":"https://github.com/bao7uo/dp_crypto","repos":[{"name":"bao7uo/dp_crypto","url":"https://github.com/bao7uo/dp_crypto","stars":178,"created":"2018-01-16"},{"name":"capt-meelo/Telewreck","url":"https://github.com/capt-meelo/Telewreck","stars":96,"created":"2018-08-03"},{"name":"blacklanternsecurity/dp_cryptomg","url":"https://github.com/blacklanternsecurity/dp_cryptomg","stars":61,"created":"2022-10-04"},{"name":"0xsharz/telerik-scanner-cve-2017-9248","url":"https://github.com/0xsharz/telerik-scanner-cve-2017-9248","stars":2,"created":"2025-05-28"},{"name":"oldboysonnt/dp","url":"https://github.com/oldboysonnt/dp","stars":0,"created":"2021-05-24"}]},"first":{"date":"2018-01-16","source":"PoC-in-GitHub","url":"https://github.com/bao7uo/dp_crypto"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/43873/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1552"],"provenance":"ai"}],"timeline":[{"date":"2017-07-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9248","provenance":"source"},{"date":"2018-01-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2018-01-24","url":"https://github.com/bao7uo/dp_crypto","provenance":"source"},{"date":"2020-10-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-296b","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-18184","provenance":"source"}],"speed":{"daysToPublicExploit":197,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1584},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2198 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9951"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}