CVE-2019-19790
📋 TL;DR
CVE-2019-19790 is a path traversal vulnerability in Telerik UI for ASP.NET AJAX's RadChart component that allows remote attackers to read and delete image files on the server. This affects all versions of RadChart, which was discontinued in 2014. Organizations using RadChart in their ASP.NET applications are vulnerable.
💻 Affected Systems
- Telerik UI for ASP.NET AJAX RadChart
📦 What is this software?
Radchart by Telerik
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete critical system files or sensitive images, potentially causing service disruption or data loss.
Likely Case
Attackers read or delete web-accessible image files, potentially exposing sensitive information or defacing websites.
If Mitigated
If the vulnerable handler is removed, no impact occurs as the attack vector is eliminated.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler
Restart Required: No
Instructions:
1. Remove the RadChart HTTP handler from web.config. 2. Find and remove <add verb="*" path="Telerik.Web.UI.ChartImage.axd" type="Telerik.Web.UI.ChartHttpHandler" validate="false" /> from web.config. 3. Consider migrating to RadHtmlChart as recommended by Telerik.
🔧 Temporary Workarounds
Remove ChartHttpHandler from web.config
windowsEliminates the vulnerable endpoint by removing the HTTP handler registration
Edit web.config and remove: <add verb="*" path="Telerik.Web.UI.ChartImage.axd" type="Telerik.Web.UI.ChartHttpHandler" validate="false" />
🧯 If You Can't Patch
- Implement WAF rules to block requests to Telerik.Web.UI.ChartImage.axd
- Restrict network access to affected systems and monitor for suspicious file operations
🔍 How to Verify
Check if Vulnerable:
Check web.config for presence of Telerik.Web.UI.ChartHttpHandler registrationCheck Version:
Check web.config for RadChart handler configurationVerify Fix Applied:
Confirm Telerik.Web.UI.ChartHttpHandler is removed from web.config and test that ChartImage.axd endpoint returns 404📡 Detection & Monitoring
Log Indicators:
- HTTP requests to Telerik.Web.UI.ChartImage.axd with path traversal patterns (../)
- Unusual file read/delete operations in application logs
Network Indicators:
- HTTP requests containing ../ sequences targeting ChartImage.axd endpoint
SIEM Query:
source="web_server" AND uri="*ChartImage.axd*" AND (uri="*../*" OR uri="*..\\*")🔗 References
- https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview
- https://www.telerik.com/forums/-620f6977edef
- https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler
- https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview
- https://www.telerik.com/forums/-620f6977edef
- https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler
