CVE-2024-11948

Executive Summary

CVE-2024-11948 is a critical remote code execution (RCE) vulnerability in GFI Archiver, stemming from the inclusion of a vulnerable version of Telerik Web UI. The flaw resides in the product installer, allowing unauthenticated attackers to execute arbitrary code in the context of the NETWORK SERVICE account. With a CVSS score of 9.8, this vulnerability poses a severe threat to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch is currently available, but the risk is amplified by the widespread use of Telerik components in enterprise environments.

Supply Chain & Package Security

This vulnerability is not directly related to NPM, PyPI, Go, or Ruby packages. However, it highlights a supply chain risk: GFI Archiver bundles a third-party component (Telerik Web UI) that contains a known vulnerability. Organizations using GFI Archiver should assess their exposure and consider compensating controls until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a prime target for ransomware groups and APT actors.

Deep Dive & Mechanics

The vulnerability exists in the GFI Archiver installer, which bundles a vulnerable version of Telerik Web UI (likely Telerik.Web.UI.dll). Telerik Web UI is a popular ASP.NET AJAX component suite. The specific flaw is a deserialization or insecure file upload issue in the Telerik RadAsyncUpload handler, which allows remote code execution. The installer does not sanitize or update the Telerik component, leaving the default vulnerable configuration intact.

Attack Flow:

1. An attacker sends a crafted HTTP request to the GFI Archiver web interface (typically on port 443 or 8080).
2. The request targets the Telerik RadAsyncUpload handler (e.g., /Telerik.Web.UI.WebResource.axd?type=rau).
3. The handler deserializes attacker-controlled data without proper validation, leading to arbitrary file upload or command execution.
4. The code executes under the NETWORK SERVICE account, which has network access and can be leveraged for lateral movement.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the bundled Telerik Web UI version. A patched version would require updating Telerik Web UI to a secure release (e.g., >= 2021.1.224 or later, depending on the specific CVE). The following shows a conceptual diff:

Vulnerable (Telerik.Web.UI.dll, version < 2021.1.224):

// In RadAsyncUploadHandler.ProcessRequest()
if (context.Request.Files.Count > 0)
{
    // Insecure deserialization of file metadata
    var metadata = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(context.Request.Form["metadata"]);
    // No validation of metadata content
    SaveFile(metadata["fileName"].ToString(), context.Request.Files[0]);
}

Patched (Telerik.Web.UI.dll, version >= 2021.1.224):

// In RadAsyncUploadHandler.ProcessRequest()
if (context.Request.Files.Count > 0)
{
    // Secure deserialization with type validation
    var metadata = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(context.Request.Form["metadata"]);
    if (!IsValidMetadata(metadata))
    {
        throw new HttpException(400, "Invalid metadata");
    }
    // Sanitize file name
    var safeFileName = SanitizeFileName(metadata["fileName"].ToString());
    SaveFile(safeFileName, context.Request.Files[0]);
}

Exploitation & Lab Setup

Red Team

Lab Environment:

• Install GFI Archiver (any version with vulnerable Telerik component) on a Windows Server 2019/2022.
• Ensure the web interface is accessible on port 443.

Exploitation Steps:

1. Identify the Telerik endpoint: https://target/Telerik.Web.UI.WebResource.axd?type=rau
2. Craft a malicious request using a tool like curl or a custom Python script:

curl -k -X POST "https://target/Telerik.Web.UI.WebResource.axd?type=rau" \
  -F "file=@shell.aspx" \
  -F "metadata={\"fileName\":\"shell.aspx\"}"

3. Access the uploaded shell: https://target/RadUploads/shell.aspx
4. Execute commands as NETWORK SERVICE.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for POST requests to /Telerik.Web.UI.WebResource.axd?type=rau with unusual file extensions (e.g., .aspx, .ashx).
• Alert on file uploads to the RadUploads directory.
• Use the YARA and Sigma rules below.

Hunting:

• Search for files named Telerik.Web.UI.dll and check their version (should be >= 2021.1.224).
• Look for suspicious processes spawned by w3wp.exe (IIS worker process) with command-line arguments like powershell or cmd.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – actual hashes depend on the specific Telerik version)
  • Telerik.Web.UI.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /Telerik.Web.UI.WebResource.axd?type=rau
  • Outbound connections from NETWORK SERVICE to external IPs on ports 80/443
• File System Indicators:
  • Files in C:\Program Files\GFI\Archiver\RadUploads\ with extensions .aspx, .ashx, .asp
  • Unusual DLLs in the GFI Archiver installation directory

Detection Engineering

YARA Rule

rule CVE_2024_11948_Telerik_RCE {
    meta:
        description = "Detects vulnerable Telerik.Web.UI.dll in GFI Archiver"
        author = "Valters IT"
        date = "2025-04-14"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "Telerik.Web.UI.WebResource.axd" ascii wide nocase
        $s2 = "RadAsyncUpload" ascii wide nocase
        $s3 = "NETWORK SERVICE" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-11948 - Telerik Web UI RCE in GFI Archiver
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts against CVE-2024-11948 via Telerik RadAsyncUpload
author: Valters IT
date: 2025/04/14
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "Telerik.Web.UI.WebResource.axd?type=rau"
        cs-method: "POST"
    condition: selection
falsepositives:
    - Legitimate Telerik uploads (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11948 - Telerik Web UI RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"Telerik.Web.UI.WebResource.axd"; http_uri; content:"type=rau"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate GFI Archiver servers from the internet if possible.
2. Apply a Web Application Firewall (WAF) rule to block requests to /Telerik.Web.UI.WebResource.axd?type=rau.
3. Disable the RadAsyncUpload handler in the web.config file:

<system.web>
    <httpHandlers>
        <remove verb="*" path="Telerik.Web.UI.WebResource.axd"/>
    </httpHandlers>
</system.web>

Long-term Fix:

• Monitor vendor channels for an official patch.
• Replace the vulnerable Telerik.Web.UI.dll with a patched version (>= 2021.1.224) if possible.
• Consider migrating to an alternative archiving solution if no patch is forthcoming.

Valters IT Signature This report is generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.