HOC Shorts
A high-severity vulnerability chain in Telerik UI for ASP.NET AJAX (RadAsyncUpload) allows unauthenticated attackers to decrypt internal metadata and trigger Remote Code Execution (RCE).
Recommended action: Upgrade to v2026.2.708 (2026 Q2 SP1) or later.
Summary
Security researchers at TantoSec disclosed a linked set of cryptographic side-channel and metadata processing flaws in Progress Telerik UI for ASP.NET AJAX.
By chaining timing and error oracles with default key fallback mechanisms, an unauthenticated remote attacker can reconstruct internal state signatures and manipulate type handlers to execute arbitrary code on the underlying IIS web server.
Vulnerability Comparison Table
| CVE ID | Vulnerability Type | CVSS v3.1 | Core Exploit Mechanism | Primary Impact |
| CVE-2026-13181 | Unsafe Type Resolution | 8.1 (High) | Forged upload metadata manipulates AsyncUploadTypeName instantiation. |
Remote Code Execution (RCE) |
| CVE-2026-13182 | Error Oracle (Decrypt vs. Parse) | 7.5 (High) | Distinguishes decryption failures from JSON parse errors. | Metadata / Key Leakage |
| CVE-2026-13183 | Timing Side-Channel Oracle | 7.5 (High) | Server response timing variations reveal cryptographic validity. | Byte-by-byte State Decryption |
| CVE-2026-13184 | Hardcoded Key Fallback | 7.5 (High) | Falls back to static keys when configuration keys are missing. | Signature Forgery |
How the Exploit Chain Works
1. Reconnaissance & Oracle Probing: Attackers send crafted queries to `Telerik.Web.UI.WebResource.axd`. Response timing and error messages reveal whether payload decryption succeeded.
2. Key & Metadata Recovery: The side-channel oracles (CVE-2026-13182, CVE-2026-13183) allow attackers to decrypt client-state metadata without knowing the secret keys.
3. Payload Forgery: If `ConfigurationHashKey` is omitted, the component falls back to default keys (CVE-2026-13184), allowing valid signature generation.
4. Arbitrary Code Execution: The signed payload overrides `AsyncUploadTypeName` (CVE-2026-13181). Upon processing the upload, the IIS worker process (`w3wp.exe`) instantiates the arbitrary type, triggering RCE.
Actionable Mitigation Checklist
- Upgrade Framework Assemblies: Deploy Telerik UI for ASP.NET AJAX v2026.2.708 (2026 Q2 SP1) or higher. This update introduces AES-GCM (Authenticated Encryption), resolving the oracle leakage.
- Disable Unused Handlers: If `RadAsyncUpload` isn’t required, disable it in `web.config`:
<appSettings>
<add key="Telerik.Web.DisableAsyncUploadHandler" value="true" />
</appSettings>3. Enforce Manual MachineKeys: Generate explicit, non-autogenerated MachineKeys in IIS using `HMACSHA256` validation.
4. Rotate Existing Keys: Assume current keys are compromised if vulnerable instances were exposed to the public internet.
