CVE-2019-18935

Think of RadAsyncUpload like a “package delivery system” inside your website: it receives uploaded data. This vulnerability lets a malicious message be treated as something trustworthy, which can trick the server into running attacker code. If the attacker also has the right secret keys, they can weaponize it to compromise the server.

This matters if you use Progress Telerik UI for ASP.NET AJAX in an ASP.NET web application—especially the RadAsyncUpload feature. You should consider exposure high if your site is reachable from the internet and the attacker has (or can obtain) the encryption keys required to exploit this. The risk is gated by that key knowledge condition; without the keys, exploitation is not expected.

This is a RED issue because it’s confirmed in real-world ransomware activity via CISA KEV. Attackers actively look for vulnerable internet-facing web apps where they can leverage this deserialization weakness to take over servers. Given the known exploitation record and the availability of public proof-of-concept, you should treat patching as an immediate priority.

1. Identify exposure

   • Inventory your ASP.NET apps and servers for “Progress Telerik UI for ASP.NET AJAX” and confirm whether RadAsyncUpload is enabled/used.
   • Record your exact Telerik UI version(s). The issue affects “through 2019.3.1023” per the CVE title provided.

2. Check whether you’re on an affected version

   • If your version is older than the vendor-fixed version(s referenced by Telerik’s advisory for CVE-2019-18935, you should assume you are affected.
   • If you have multiple web apps, repeat the check per app because Telerik UI can be bundled per application.

3. Upgrade to the fixed release

   • Apply Telerik’s vendor updates per the official guidance linked from Telerik support/advisory material for ASP.NET AJAX deserialization.
   • Practical target: upgrade to the fixed version(s) recommended by Telerik for this vulnerability.

4. Temporary containment if patching is delayed

   • Restrict access so affected endpoints are not broadly reachable from the public internet (for example, limit by IP allowlist, put behind a VPN, or otherwise restrict external access).
   • Review your web server/WAF rules to reduce exposure to RadAsyncUpload upload attempts.

5. Validate results after patch

   • Re-check the deployed Telerik UI package version on each affected app.
   • Confirm the application restarts cleanly and that RadAsyncUpload still works as expected.

6. Monitor for hostile activity

   • Look for abnormal upload attempts and server errors around RadAsyncUpload.
   • Alert on repeated requests that target the upload flow and on any unexpected processes spawned by the web server.

7. Deadline

   • CISA KEV lists a remediation due date of 2022-05-03; treat your upgrade as overdue if not already completed.

CVE-2019-18935 is a Telerik UI for ASP.NET AJAX (RadAsyncUpload) .NET deserialization vulnerability (CWE-502). The mechanism is deserialization of untrusted data where exploitation becomes feasible when an attacker knows the encryption keys used by the feature—meaning an attacker can craft inputs that cause arbitrary code execution on the server.

Exploitation status: It is listed in CISA KEV and has been used in ransomware campaigns (CISA-added 2021-11-03). A public proof-of-concept exists, and press attention has been sustained.

Attack characteristics from findings: network-based, no authentication required, no user interaction required. Preconditions include attacker possession of the relevant encryption keys.

Patch guidance: apply vendor updates per Telerik’s advisory/KB and associated release history; follow any third-party application vendor instructions if Telerik is bundled into a larger product.