Telerik UI for ASP.NET AJAX Padding-Oracle Chain: Unauthenticated RCE Detection and Remediation Guide

TantoSec has published a working proof-of-concept chain that converts a classic AES-CBC padding oracle weakness in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. This is the kind of disclosure that changes the math for every IIS shop running Telerik controls: a cryptographic side channel — something many teams classify as 'medium severity, fix in the next cycle' — is now demonstrably a stepping stone to full server compromise.

There are two important scoping facts before anyone panics or, worse, dismisses this: exploitation requires a specific non-default configuration of the vulnerable component, and Progress shipped a patch for the chain in July 2026. There are no confirmed reports of exploitation in the wild at this time. That window — public PoC, patch available, no confirmed in-the-wild abuse — is exactly when disciplined defenders move fastest. Historically, Telerik UI for ASP.NET AJAX flaws have been some of the most aggressively mass-exploited vulnerabilities in the IIS ecosystem once PoCs circulate. Treat this as a pre-exploitation emergency, not a curiosity.

What Happened

TantoSec's research demonstrates a two-stage chain:

1. Padding oracle exploitation: The Telerik UI cryptographic handling of certain request parameters uses AES in CBC mode and leaks, through differential application responses, whether decrypted padding is valid. By sending crafted ciphertexts and observing oracle responses, an attacker can iteratively forge valid ciphertext without knowing the encryption key.
2. Code execution: With the ability to forge valid ciphertext, the attacker can construct malicious serialized/deserialized input that the application trusts, yielding unauthenticated remote code execution in the context of the IIS worker process (w3wp.exe).

The critical caveat: the chain only succeeds against applications running a specific non-default configuration of Telerik UI for ASP.NET AJAX. This means your exposure assessment has two dimensions — patch level and configuration state. An unpatched-but-default-configured app may not be exploitable via this chain; a patched-but-hardened app is the target end state.

Exploitation status: Public working PoC (TantoSec). No confirmed in-the-wild exploitation as of publication. Not yet listed in CISA KEV. Patch available from Progress since July 2026.

Technical Analysis

Affected Component

• Product: Telerik UI for ASP.NET AJAX (Progress Software)
• Platform: Windows Server running IIS with ASP.NET applications embedding Telerik UI controls
• Attack surface: Unauthenticated HTTP(S) requests to Telerik resource and upload handlers — typically endpoints such as Telerik.Web.UI.WebResource.axd and the RadAsyncUpload handler — reachable from wherever the application is exposed
• Prerequisite: Non-default configuration enabling the vulnerable cryptographic handling path

Why a Padding Oracle Is Worse Than It Sounds

Padding oracle attacks (Bleichenbacher-style, applied to CBC) are often underrated in triage because they sound academic. In practice, against a web-facing .NET control they are devastating for three reasons:

1. They are fully automatable. The oracle is a binary signal (valid vs. invalid padding reflected in response behavior). An attacker script can grind through ciphertext block decryption byte-by-byte with predictable request counts.
2. They defeat the key-management control. The whole point of encrypting/integrity-protecting client-influenced parameters is that the attacker can't forge them. A padding oracle sidesteps the key entirely.
3. They chain. Once ciphertext forgery is possible, whatever the application decrypts and trusts next — serialized objects, file paths, type names — becomes attacker-controlled. That is the bridge to RCE demonstrated in this PoC.

Defender's View of the Attack Chain

From a telemetry perspective, exploitation has observable fingerprints:

• High-volume, iterative requests to Telerik handler endpoints from a single source (the oracle grinding phase). Legitimate users do not send hundreds-to-thousands of subtly varied requests to a .axd resource handler.
• Malformed or abnormally long encrypted parameter values in query strings or POST bodies to Telerik endpoints.
• Post-exploitation behavior: w3wp.exe spawning child processes (cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe), writing web shells (.aspx, .ashx, .asmx) into web root paths, or making unexpected outbound connections.

The post-exploitation telemetry is your most reliable detection layer, because it is independent of whether you correctly identified the vulnerable configuration.

Detection & Response

SIGMA Rules

---
title: IIS Worker Process Spawning Command Shell or Scripting Engine
id: 3f9c1a72-8b4e-4d2a-9f15-7c6e2a91d304
status: experimental
description: Detects w3wp.exe spawning cmd.exe, powershell.exe, or common post-exploitation tooling, consistent with web application RCE such as the Telerik UI padding-oracle chain.
references:
  - https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy ASP.NET applications legitimately shell out for PDF generation or imaging — baseline by application pool identity
level: high
---
title: Web Shell Dropped by IIS Worker Process
id: 8a2d6f14-1c73-4b58-a2e9-4f07b3d85612
status: experimental
description: Detects w3wp.exe writing script-executable files into web content directories, a hallmark of post-RCE web shell deployment following exploitation of Telerik UI or similar web-facing flaws.
references:
  - https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\w3wp.exe'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.cshtml'
  selection_path:
    TargetFilename|contains:
      - '\inetpub\'
      - '\wwwroot\'
      - '\www\'
  condition: selection_image and selection_ext and selection_path
falsepositives:
  - Legitimate deployments and CMS publishing workflows — correlate with change windows and deployment pipeline activity
level: high
---
title: Suspicious High-Volume Requests to Telerik Resource Handler
id: c17b4e92-5d38-4a61-b3f8-9e21a7c46f85
status: experimental
description: Detects abnormally long or repetitive encrypted parameter patterns targeting Telerik.Web.UI.WebResource.axd or RadAsyncUpload endpoints, consistent with padding-oracle grinding behavior.
references:
  - https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - 'Telerik.Web.UI.WebResource.axd'
      - 'RadAsyncUpload'
  selection_query:
    cs-uri-query|contains:
      - 'type='
      - 'download='
      - 'file='
      - 'prkey='
      - 'rauUpld'
  condition: selection_uri and selection_query
falsepositives:
  - Legitimate Telerik control usage — this rule is a triage pivot, not a standalone verdict; pair with request-volume analysis per source IP
level: medium

KQL — Microsoft Sentinel / Defender

Use this to hunt both the pre-exploitation oracle grinding (via IIS/W3C logs ingested to Sentinel) and post-exploitation process behavior (via Defender for Endpoint):

// Stage 1: Hunt for padding-oracle grinding against Telerik handlers in IIS logs
W3CIISLog
| where TimeGenerated > ago(14d)
| where csUriStem has_any ("Telerik.Web.UI.WebResource.axd", "RadAsyncUpload")
| summarize RequestCount = count(),
            DistinctQueries = dcount(csUriQuery),
            LongQueryRequests = countif(strlen(csUriQuery) > 200),
            Statuses = make_set(scStatus)
    by cIP, csUriStem, bin(TimeGenerated, 1h)
| where RequestCount > 50 or LongQueryRequests > 10
| order by RequestCount desc;

// Stage 2: Post-exploitation — w3wp.exe spawning shells or LOLBins (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","cscript.exe","wscript.exe","net.exe","whoami.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Stage 3: Web shell file drops by IIS worker process
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName endswith_any (".aspx",".ashx",".asmx",".asp",".cshtml")
| where FolderPath has_any ("inetpub","wwwroot")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

Velociraptor VQL

For rapid triage of IIS servers where you suspect exploitation, hunt child processes of the worker process and recently written executable-content files under web roots:

-- Hunt for suspicious child processes of w3wp.exe and recent web shell artifacts
LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)w3wp'
   OR CommandLine =~ '(?i)(powershell|cmd\.exe|certutil|bitsadmin|mshta)'
ORDER BY CreateTime DESC;

LET shell_hunt = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/inetpub/**/*.as{x,hx,mx,p}', accessor='ntfs')
WHERE Mtime > now() - 1209600  -- files modified in last 14 days
ORDER BY Mtime DESC;

SELECT * FROM proc_hunt;
SELECT * FROM shell_hunt;

Note: in production, split these into two artifacts rather than chaining the SELECTs — Velociraptor notebooks handle one result set cleanly per artifact cell. The ntfs accessor lets you catch timestomped-but-present files that the standard API glob may miss.

Remediation / Verification Script

The following PowerShell audits an IIS server for Telerik UI for ASP.NET AJAX presence, reports deployed assembly versions (so you can compare against the July 2026 patched release), and flags the non-default configuration indicators you must review:

# Telerik UI for ASP.NET AJAX exposure audit — run elevated on each IIS server
# 1) Locate Telerik.Web.UI.dll instances across web roots
$searchRoots = @('C:\inetpub')
$dlls = Get-ChildItem -Path $searchRoots -Recurse -Filter 'Telerik.Web.UI.dll' -ErrorAction SilentlyContinue

if ($dlls) {
    foreach ($dll in $dlls) {
        $ver = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dll.FullName)
        [PSCustomObject]@{
            Path           = $dll.FullName
            ProductVersion = $ver.ProductVersion
            FileVersion    = $ver.FileVersion
        }
    }
    Write-Warning 'Telerik.Web.UI.dll found. Compare ProductVersion against the Progress July 2026 security release and upgrade immediately if older.'
} else {
    Write-Host 'No Telerik.Web.UI.dll found under C:\inetpub.' -ForegroundColor Green
}

# 2) Audit web.config files for Telerik handler registrations and non-default keys
$configs = Get-ChildItem -Path $searchRoots -Recurse -Filter 'web.config' -ErrorAction SilentlyContinue
foreach ($cfg in $configs) {
    $content = Get-Content $cfg.FullName -Raw -ErrorAction SilentlyContinue
    $flags = @()
    if ($content -match 'Telerik\.Web\.UI\.WebResource\.axd') { $flags += 'WebResource.axd handler registered' }
    if ($content -match 'RadAsyncUpload') { $flags += 'RadAsyncUpload handler present' }
    if ($content -match 'Telerik\.AsyncUpload\.ConfigurationEncryptionKey') { $flags += 'NON-DEFAULT: AsyncUpload ConfigurationEncryptionKey set — review against vendor hardening guidance' }
    if ($content -match 'Telerik\.Upload\.ConfigurationHashKey') { $flags += 'ConfigurationHashKey set' }
    if ($content -match 'Telerik\.Web\.UI\.DialogParametersEncryptionKey') { $flags += 'DialogParametersEncryptionKey set' }
    if ($flags.Count -gt 0) {
        Write-Host "`n$($cfg.FullName)" -ForegroundColor Cyan
        $flags | ForEach-Object { Write-Host "  - $_" }
    }
}

# 3) Quick check: recent executable-content files written to web roots (14-day window)
Get-ChildItem -Path $searchRoots -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, LastWriteTime, Length |
    Sort-Object LastWriteTime -Descending

Cross-reference every ProductVersion from step 1 against the Progress advisory for the July 2026 release. Any Telerik key material found in step 2 that is hardcoded, shared across environments, or committed to source control must be rotated — the PoC demonstrates that crypto key management is the entire control here.

Remediation

1. Patch to the July 2026 Progress release. Progress remediated this chain in the July 2026 Telerik UI for ASP.NET AJAX update. Upgrade every deployed instance — including applications you may have forgotten embed the controls (vendor-packaged apps, SharePoint integrations, legacy intranet portals are the usual stragglers). Pull the official advisory from the Progress security portal: https://www.progress.com/security and the Telerik UI for ASP.NET AJAX release notes.
2. Audit configuration state, not just version. The chain requires a non-default configuration. Review every web.config for Telerik-specific appSettings and handler registrations. Where the vulnerable feature path is enabled but not business-required, disable it — this is your compensating control while patching is scheduled.
3. Rotate all Telerik cryptographic keys. ConfigurationEncryptionKey, ConfigurationHashKey, and DialogParametersEncryptionKey must be unique, randomly generated per environment, and never committed to source control. If keys have ever been exposed (repo history, config backups, shared images), assume compromise and rotate.
4. Restrict handler exposure. Where feasible, require authentication or IP allowlisting at the IIS/reverse-proxy layer for Telerik handler paths on applications that do not need anonymous access to them. A WAF rule rate-limiting per-source requests to Telerik.Web.UI.WebResource.axd will meaningfully degrade the oracle-grinding phase.
5. Hunt retroactively. Run the KQL and VQL hunts above across at least the last 30 days of telemetry. Public PoCs get operationalized within days; check whether anyone was already grinding your handlers before the disclosure.
6. Validate egress and segmentation on IIS servers. A compromised w3wp.exe should not be able to reach the internet freely or pivot laterally. Confirm outbound firewall rules and that application pool identities run least-privilege.
7. Add Telerik to your asset inventory permanently. If your CMDB cannot answer 'which applications embed Telerik UI for ASP.NET AJAX and at what version' within an hour, fix that gap now — this product family has a track record of high-impact flaws and will appear in your triage queue again.

The Bottom Line

This disclosure is a textbook case of why cryptographic side channels in web-facing components deserve high-severity treatment even when they sound theoretical. The padding oracle was the lockpick; the non-default configuration was the unlocked door behind it. Progress has done its part — the patch shipped in July. The PoC is public. Exploitation in the wild is a matter of when, not if, given this product's exploitation history. Patch, audit configuration, rotate keys, and hunt back 30 days. Do it this week.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub