Cryptographic Weakness in Progress Telerik UI for ASP.NET AJAX (CVE‑2017‑9248) Risks Key Disclosure and XSS
What It Is – A cryptographic weakness in Telerik.Web.UI.dll allows an attacker to recover the DialogParametersEncryptionKey and/or the ASP.NET MachineKey. The flaw also enables cross‑site scripting, ViewState tampering, and arbitrary file upload/download.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. The vulnerability is rated 7.5 High (CVSS 3.1). No known active exploit campaigns, but the attack surface is broad for any site that ships the vulnerable DLL.
Affected Products – Progress Telerik UI for ASP.NET AJAX (all versions prior to the vendor’s 2017‑Q4 patch) and Sitefinity CMS that embed the same UI library.
Why It Matters for Trust & Control Assurance
- Control Objective – Cryptographic Key Management & Secure Configuration – The flaw shows that reliance on third‑party components without continuous verification can break key‑protection controls required by many frameworks.
- Supply‑Chain Assurance – Demonstrates the need for an up‑to‑date software bill of materials (SBOM) and automated monitoring of component vulnerabilities to maintain a defensible audit trail.
- Continuous Control Monitoring – Evidence that a component is patched and its configuration aligns with cryptographic best practices can be captured and presented to auditors or customers as proof of control effectiveness.
Recommended Actions
- Inventory all web applications that include
Telerik.Web.UI.dll. - Patch to the latest vendor‑released version (or apply the published hot‑fix).
- Rotate any exposed
MachineKeyvalues and re‑generateDialogParametersEncryptionKey. - Add the component to your SBOM and enable automated vulnerability scanning for future releases.
- Document the remediation steps and map them to the “cryptographic key protection” control in your framework of record.
Source: CISA KEV – CVE‑2017‑9248