# Telerik UI Padding Oracle Chained to Unauthenticated RCE
A padding oracle vulnerability in Telerik UI for ASP.NET AJAX can be weaponized into unauthenticated remote code execution, security researchers at TantoSec demonstrated this week with a released proof-of-concept exploit. The attack chains an AES-CBC cryptographic weakness with additional flaws to bypass authentication entirely and execute arbitrary code on vulnerable servers.
Progress Software, which owns Telerik, issued patches in July 2024 addressing this vulnerability chain. No confirmed exploitation has occurred in the wild, but the public release of working code elevates the practical risk for organisations running unpatched instances in non-standard configurations.
The vulnerability originates in how Telerik UI for ASP.NET AJAX handles encryption for serialized objects. The AES-CBC mode implementation allows attackers to manipulate encrypted payloads and observe server responses. By crafting specific ciphertext blocks and monitoring error messages or timing differences, an attacker can decrypt sensitive data byte by byte without knowing the encryption key. This padding oracle technique, first documented by Belgian researcher Serge Vaudenay in 1992, remains a practical threat when CBC mode is used improperly.
TantoSec's exploit chain extends beyond simple decryption. The researchers identified additional vulnerabilities within Telerik UI that allow an attacker to leverage the decrypted data to achieve unauthenticated code execution. The full attack requires the vulnerable application to run in a non-default configuration, meaning many Telerik deployments remain unaffected. However, organisations using non-standard setups face direct risk.
Telerik UI for ASP.NET AJAX powers web applications across financial services, government agencies, and enterprise environments. A successful unauthenticated RCE attack would grant attackers the same privileges as the web application process, potentially allowing lateral movement into internal networks, data exfiltration, or deployment of persistent backdoors.
The timeline matters. Progress released patches in July 2024 through their regular security updates. The public exploit code released this week applies pressure on organisations that have not yet applied patches. Security teams using Telerik UI must verify their current version against Progress security advisories and prioritise patching in their update cycles.
Detection proves challenging for organisations without comprehensive security telemetry. The attack exploits the normal encryption mechanisms within Telerik, making network-level detection difficult without deep packet inspection and decryption capabilities. Application-level logging may reveal patterns of malformed requests, but identifying padding oracle probes requires monitoring for specific error signatures.
Organisations should treat this as a moderate-priority patch. The non-default configuration requirement limits the blast radius, but the unauthenticated nature of the attack means any vulnerable instance becomes an active target once exploit code circulates. The release of working code accelerates the timeline for exploitation in the wild. Security teams should audit their Telerik deployments immediately to confirm configuration details and apply patches without delay.
Progress Software maintains a public security advisory database. Organisations should cross-reference their Telerik UI version against these advisories and follow the vendor's patching guidance. If immediate patching is impossible, implementing network segmentation to restrict access to Telerik-powered applications reduces the attack surface significantly.