Telerik.Web.UI.dll Cryptographic Weakness - Vulnerability Database

Telerik.Web.UI.dll Cryptographic Weakness

Description

The Telerik.Web.UI.dll library contains a cryptographic weakness that allows attackers to decrypt and recover sensitive encryption keys, specifically the Telerik.Web.UI.DialogParametersEncryptionKey and the ASP.NET MachineKey. This vulnerability affects applications using Telerik UI for ASP.NET AJAX components and stems from weak cryptographic implementation that can be exploited through cryptanalysis techniques.

Remediation

Apply one of the following mitigation strategies based on your current Telerik version:

Option 1: Apply Security Patches (Recommended)

For versions Q1 2013 (2013.1.220) through R2 2017 (2017.2.503): Download and apply the official security patch from Telerik
For versions Q1 2011 (2011.1.315) through Q3 2012 SP2 (2012.3.1308): Apply the available patch if your specific version is supported

Option 2: Upgrade to Patched Version

If you have active maintenance, upgrade to R2 2017 SP1 (2017.2.621) or later, which includes the security fix by default

Option 3: Disable Vulnerable Component

Block access to the Telerik Dialog Handler by adding the following to your web.config:

<configuration>
  <system.webServer>
    <handlers>
      <remove name="Telerik_Web_UI_DialogHandler_aspx" />
    </handlers>
  </system.webServer>
</configuration>

Additional Hardening:

Set a strong custom encryption key in web.config using the Telerik.Web.UI.DialogParametersEncryptionKey appSetting
Ensure your ASP.NET MachineKey is explicitly configured with a strong, randomly generated value rather than relying on auto-generation
Review and restrict file upload capabilities if using RadAsyncUpload controls