Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities
Se muestra el contenido original; la traduccion localizada aun no esta disponible.
Qué ocurrió
A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities
Por que importa
The incident may affect operational continuity, asset safety or trust around Security. Watch for verified scope and remediation.
Entidades afectadas
Ver evidencia
1 articulos · 1 informe original · 1 independientes
- The Hacker NewsFuente primaria · Respalda · EN · 100%Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released ↗
Afirmaciones
- Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released Observado
Conflictos
No se detectaron conflictos importantes en la evidencia disponible.
Cronología
- Primera publicación
Movimiento del mercado posterior al evento
La reacción del mercado aún no está disponible para este activo y periodo.