CVE-2026-6023

Executive Summary

CVE-2026-6023 is a critical vulnerability in Progress® Telerik® UI for AJAX, affecting versions 2024.4.1114 through 2026.1.421. The flaw resides in the RadFilter control, which performs insecure deserialization of user-supplied filter state data. If an attacker can tamper with the serialized state (which is exposed to the client), they can achieve server-side remote code execution (RCE). The CVSS score is 8.1 (High), and no patch is currently available. This vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network.

Supply Chain & Package Security

This vulnerability affects a commercial UI component library (Telerik UI for AJAX), not an open-source package. There is no NPM, PyPI, Go, or Ruby package involved. The risk is limited to organizations that have deployed the affected versions of the Telerik UI for AJAX suite in their web applications.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full data access possible.
• Integrity Impact: High (I:H) – full data modification possible.
• Availability Impact: High (A:H) – full system compromise possible.

Threat Level: Critical. The combination of network exploitability, no authentication, and RCE makes this a top-priority vulnerability for any organization using the affected Telerik versions.

Deep Dive & Mechanics

The RadFilter control in Telerik UI for AJAX allows users to apply filters to data (e.g., in a grid). To persist filter state across postbacks, the control serializes the filter configuration and stores it in a hidden field or ViewState. This serialized state is exposed to the client.

The vulnerability arises because the deserialization process does not validate or sanitize the incoming serialized data. An attacker can craft a malicious serialized object (e.g., using .NET's BinaryFormatter or SoapFormatter) and submit it as the filter state. When the server deserializes this object, it can execute arbitrary code.

Key technical details:

• The vulnerable component is Telerik.Web.UI.RadFilter.
• The serialized state is typically stored in a hidden input field named RadFilter1_ClientState or similar.
• The deserialization occurs on the server during postback when the filter state is restored.
• The attack does not require authentication if the page hosting the RadFilter is publicly accessible.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely looks like this:

Vulnerable (C#):

// Vulnerable: Direct deserialization without validation
string filterState = Request.Form["RadFilter1_ClientState"];
BinaryFormatter formatter = new BinaryFormatter();
using (MemoryStream stream = new MemoryStream(Convert.FromBase64String(filterState)))
{
    RadFilterState state = (RadFilterState)formatter.Deserialize(stream);
    // Apply state...
}

Patched (hypothetical):

// Patched: Use a safe deserialization method or validate input
string filterState = Request.Form["RadFilter1_ClientState"];
// Option 1: Use JSON serialization with type validation
var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None // Disable polymorphic deserialization
};
RadFilterState state = JsonConvert.DeserializeObject<RadFilterState>(filterState, settings);

// Option 2: Validate the serialized data against an allowlist
if (!IsValidFilterState(filterState))
{
    throw new InvalidOperationException("Invalid filter state.");
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target web application using Telerik UI for AJAX version 2024.4.1114 to 2026.1.421.
• A page that exposes a RadFilter control (e.g., a grid with filtering enabled).
• No authentication required if the page is public.

Exploitation Steps:

1. Identify the vulnerable endpoint: Navigate to a page with a RadFilter. Inspect the HTML source for a hidden input field like RadFilter1_ClientState. Its value will be a Base64-encoded serialized object.

2. Craft a malicious payload: Use a tool like ysoserial.net to generate a .NET deserialization payload. For example, to execute a command:

   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe" -o base64
   

   This generates a Base64-encoded payload that, when deserialized, executes calc.exe.

3. Replace the state: Using a proxy (e.g., Burp Suite), intercept the POST request and replace the RadFilter1_ClientState value with your malicious payload.

4. Trigger deserialization: Submit the request. The server will deserialize the payload, executing your command.

Example payload (Base64):

AAEAAAD/////AQAAAAAAAAAMAgAAAF5TeXN0ZW0uVGV4dC5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMsIFN5c3RlbS5UZXh0LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYQUBAAAAIQBTeXN0ZW0uVGV4dC5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMvU3lzdGVtLlRleHQuVGV4dEZvcm1hdHRpbmdSdW5Qcm9wZXJ0aWVzBAAAAA5Gb3JlZ3JvdW5kQnJ1c2gAEUZvcmVncm91bmRCcnVzaEJhc2UADUZvcmVncm91bmRCcnVzaAALRm9yZWdyb3VuZAEBAQID

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual Base64-encoded strings in POST parameters related to RadFilter.
• Look for deserialization-related exceptions in application logs (e.g., System.Runtime.Serialization.SerializationException).
• Use network detection rules (see Suricata below) to identify known ysoserial payload patterns.

Mitigation:

• If possible, disable the RadFilter control or remove it from publicly accessible pages.
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious RadFilter1_ClientState values.
• Apply input validation: ensure the deserialized object matches expected types and structure.

Indicators of Compromise (IOCs)

• Network:
  • POST requests containing a RadFilter1_ClientState parameter with an unusually long Base64 string.
  • Base64 strings that, when decoded, contain .NET serialization headers (e.g., \x00\x01\x00\x00\x00\xff\xff\xff\xff).
• Host:
  • Unexpected processes spawned (e.g., calc.exe, powershell.exe, cmd.exe) from the web application pool.
  • New files written to the web root or temporary directories.
  • Unusual outbound network connections from the web server.
• Logs:
  • Application logs showing System.Runtime.Serialization.SerializationException or System.InvalidCastException.
  • IIS logs showing POST requests to pages with RadFilter and a large RadFilter1_ClientState parameter.

Detection Engineering

YARA Rule

rule CVE_2026_6023_Telerik_Deserialization {
    meta:
        description = "Detects malicious serialized payloads targeting CVE-2026-6023 in Telerik UI for AJAX"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-6023"
    strings:
        $binary_header = { 00 01 00 00 00 ff ff ff ff }
        $telerik_marker = "Telerik.Web.UI.RadFilter" nocase
        $ysoserial_gadget = "TextFormattingRunProperties" nocase
    condition:
        $binary_header at 0 and ( $telerik_marker or $ysoserial_gadget )
}

Sigma Rule

title: CVE-2026-6023 Telerik RadFilter Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests with suspicious RadFilter1_ClientState parameter indicating deserialization attack
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'RadFilter1_ClientState'
    filter:
        cs-uri-query|re: 'RadFilter1_ClientState=[A-Za-z0-9+/]{1,100}={0,2}'  # Normal short state
    condition: selection and not filter
falsepositives:
    - Legitimate long filter states (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-6023 Telerik RadFilter Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"RadFilter1_ClientState"; http_client_body; pcre:"/RadFilter1_ClientState=[A-Za-z0-9+/]{200,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable RadFilter: If possible, remove or disable the RadFilter control from all pages until a patch is available.
2. Apply WAF Rules: Block POST requests with RadFilter1_ClientState parameters exceeding a reasonable length (e.g., > 200 characters).
3. Monitor Logs: Actively search for deserialization exceptions and unusual process creation.

Long-term Fix:

• Apply the official patch from Progress when it becomes available.
• Upgrade to a patched version of Telerik UI for AJAX.
• Implement secure deserialization practices in all custom code (e.g., use DataContractSerializer with type validation, or JSON serialization with TypeNameHandling.None).

Workaround:

• If the RadFilter is essential, consider implementing a server-side proxy that validates and sanitizes the filter state before passing it to the RadFilter control.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2026-6023

{/* [Security Hash: E2BBBABA0293EEFDC0AECE4F] */}