Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec released a public exploit chain turning a Telerik UI for ASP.NET AJAX padding oracle into unauthenticated remote code execution The attack targets the RadAsyncUpload control (versions 2010.1.309 through 2026.2.519) using CVE-2026-13181 (unguarded type resolution, CVSS 8.1) chained with CVE-2026-13182 (AES-CBC padding oracle) and CVE-2026-13183 (timing-based oracle variant) Exploitation requires specific non-default preconditions: a page rendering RadAsyncUpload with a server-side handle
Analysis
TL;DR
- TantoSec released a public exploit chain turning a Telerik UI for ASP.NET AJAX padding oracle into unauthenticated remote code execution
- The attack targets the RadAsyncUpload control (versions 2010.1.309 through 2026.2.519) using CVE-2026-13181 (unguarded type resolution, CVSS 8.1) chained with CVE-2026-13182 (AES-CBC padding oracle) and CVE-2026-13183 (timing-based oracle variant)
- Exploitation requires specific non-default preconditions: a page rendering RadAsyncUpload with a server-side handler reading upload results, plus an explicit custom encryption key — a setting Telerik itself recommends for hardening
- The chain requires approximately 127,000 oracle requests (~1 hour against a lab target) to forge encrypted upload configuration, specify an arbitrary .NET type, and load a malicious mixed-mode DLL for code execution under IIS application pool privileges
- Progress patched the flaws in July 2026 (version 2026.2.708) by replacing AES-CBC with authenticated encryption; no confirmed in-the-wild exploitation as of September 7
Why It Matters
This exploit demonstrates how a seemingly defensive configuration choice — setting a custom encryption key for hardening — can actually enable a complete unauthenticated RCE chain when combined with a padding oracle and unsafe deserialization. For AI practitioners and security teams, it underscores the critical importance of authenticated encryption over raw AES-CBC and the compounding risk of chaining older vulnerability classes (padding oracles + type resolution flaws) even years after individual fixes are available.
Technical Details
- Vulnerability chain: CVE-2026-13182 (padding oracle via AES-CBC without integrity check on client-side state), CVE-2026-13181 (unguarded .NET type resolution without allowlist), CVE-2026-13183 (timing-based oracle when detailed errors are suppressed), and CVE-2026-13184 (predictable default key in an alternative attack mode)
- Attack mechanics: The attacker exploits the padding oracle to decrypt and forge the encrypted RadAsyncUpload configuration without knowing the key, leveraging a fixed encryption seed. The forged configuration specifies an arbitrary .NET type that the control resolves and deserializes into a gadget loading a malicious mixed-mode DLL from an attacker-controlled location
- Exploit tooling: TantoSec released
telerik-rau-exploit, a command-line tool with two payloads — a disk-writing web shell DLL and an in-memory mixed-mode assembly — paired with a detailed technical write-up - Affected scope: RadAsyncUpload versions 2010.1.309 through 2026.2.519; fixed in 2026.2.708 (2026 Q2 SP1). Progress's July bulletin also covers a separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) with no public exploit yet
- Performance: ~127,000 oracle requests for end-to-end exploitation; timing-based variant is slower and rate-limited servers extend the window further
Industry Insight
- Custom hardening settings can introduce risk: Telerik's own recommendation to set a custom encryption key became the enabler for this chain — organizations should audit whether recommended security configurations are actually reducing attack surface or creating new ones
- Behavioral detection over signature hunting: Progress warns that successful exploitation leaves no obvious trace in standard ASP.NET error logs; defenders should monitor for anomalous w3wp.exe spawning cmd.exe, unexpected .aspx files, or mixed-mode DLLs in upload temp folders rather than relying on error log analysis
- Patch urgency despite no confirmed exploitation: While no in-the-wild attacks are confirmed, the public release of a ready-to-run exploit with detailed documentation significantly lowers the barrier for attackers; upgrading to 2026.2.708+ is the only official remediation, and interim mitigations (disabling the handler, adjusting customErrors) should be treated as temporary measures
Disclaimer: The above content is generated by AI and is for reference only.