The attack hinges on a cryptographic weakness in the Telerik UI component's handling of encrypted data. By repeatedly sending crafted requests and observing the server's padding-error responses, an attacker can decrypt sensitive payloads without valid credentials. TantoSec's research demonstrates how this oracle can then be leveraged to forge a malicious request, ultimately achieving code execution on the target server.

It is important to note that this exploit does not affect every deployment. The attack only succeeds against applications that are using a configuration which is not the default. Organizations running standard, out-of-the-box settings are not exposed to this specific chain. Administrators should verify their deployment configuration against the guidance provided in the July advisory from Progress.

Given the severity of potential unauthenticated RCE, immediate action is recommended for affected users:

• Apply the latest patches released by Progress in July if you have not already done so.
• Review your Telerik UI for ASP.NET AJAX configuration to confirm whether you are running the vulnerable non-default setup.
• Monitor for any unsolicited encrypted payloads or anomalous network traffic directed at web servers, as padding-oracle attacks generate distinctive error patterns.

Source: The Hacker News

Has your team audited your Telerik UI deployments to confirm whether they fall into that non-default configuration, or are you waiting on the patch cycle to catch up?