CVE-2018-17060

Vulnerability

The Telerik Extensions for ASP.NET MVC, now obsolete since June 2013, fails to implement a request whitelist in all versions. This allows a remote attacker to bypass intended access controls and read arbitrary files located inside the server's web directory [1]. No version is exempt; the product is end-of-life.

Exploitation

A remote attacker needs only network access to the web application. No authentication is required. The attacker sends crafted HTTP requests to the vulnerable application, which processes them without verifying the target path against an allowed list, thereby serving files from the web directory [1].

Impact

Successful exploitation leads to unauthorized disclosure of files from the web root. This may include sensitive configuration files, source code, or other data that should not be publicly accessible, resulting in a confidentiality breach [1][2].

Mitigation

The Telerik Extensions for ASP.NET MVC product has been obsolete since June 2013 and no security patches are available. The vendor recommends migrating to the current Telerik UI for ASP.NET MVC suite, which does not contain this vulnerability [2]. There is no workaround for the affected product.