| 취약점ID |
210195 |
| 위험도 |
40 |
| 포트 |
80, ... |
| 프로토콜 |
TCP |
| 분류 |
WWW |
| 상세설명 |
ASP.NET AJAX 용 Progress Telerik UI 2019.3.1023 버전까지에는 RadAsyncUpload 함수에 .NET 역 직렬화 취약점이 포함되어 있습니다.
* 참고 사이트:
https://github.com/ThanHuuTuan/Telerik_CVE-2019-18935/blob/master/telerik_rce_scan.py
http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html
http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html
https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
https://github.com/bao7uo/RAU_crypto
https://github.com/noperator/CVE-2019-18935
https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)
https://www.telerik.com/support/whats-new/release-history
* 영향을 받는 플랫폼:
Upgrade Progress Telerik UI for ASP.NET AJAX 2019.3.1023 이전 버전 |
| 해결책 |
Upgrade Progress Telerik UI for ASP.NET AJAX을 2019.3.1023 이후 버전으로 업그레이드 한다. |
| 관련 URL |
CVE-2019-18935 (CVE) |
| 관련 URL |
(SecurityFocus) |
| 관련 URL |
(ISS) |
|
