CVE-2021-28141
📋 TL;DR
This CVE describes a vulnerability in Progress Telerik UI for ASP.NET AJAX that allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. Attackers can potentially execute code on the server by injecting commands via the _TSM_HiddenField_ parameter. Organizations using affected versions of Telerik UI for ASP.NET AJAX are at risk.
💻 Affected Systems
- Progress Telerik UI for ASP.NET AJAX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing remote code execution, data exfiltration, and complete system control.
Likely Case
Unauthorized access to server resources and potential code execution leading to data breach or system manipulation.
If Mitigated
Limited impact with proper input validation and access controls preventing command injection.
🎯 Exploit Status
Exploitation involves URI manipulation with command injection via _TSM_HiddenField_ parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not provided by vendor
Vendor Advisory: Not available - vendor disputes vulnerability
Restart Required: No
Instructions:
Upgrade to latest Telerik UI version and implement input validation controls.
🔧 Temporary Workarounds
Input Validation Filter
windowsImplement strict input validation for _TSM_HiddenField_ parameter
Implement ASP.NET request filtering for Telerik.Web.UI.WebResource.axd
Access Restriction
windowsRestrict access to Telerik.Web.UI.WebResource.axd file
Add web.config rules to limit access to authorized users only
🧯 If You Can't Patch
- Implement WAF rules to block suspicious requests to WebResource.axd
- Monitor and alert on access attempts to Telerik.Web.UI.WebResource.axd with unusual parameters
🔍 How to Verify
Check if Vulnerable:
Test if Telerik.Web.UI.WebResource.axd is accessible and accepts _TSM_HiddenField_ parameter with command injectionCheck Version:
Check Telerik UI assembly version in web.config or bin directoryVerify Fix Applied:
Verify input validation blocks malicious _TSM_HiddenField_ parameters and access to WebResource.axd is properly restricted📡 Detection & Monitoring
Log Indicators:
- Requests to Telerik.Web.UI.WebResource.axd with _TSM_HiddenField_ parameter containing suspicious characters
Network Indicators:
- Unusual traffic patterns to WebResource.axd endpoints
SIEM Query:
source="web_server" AND uri="*WebResource.axd*" AND (param="*_TSM_HiddenField_*" OR contains(param, "cmd") OR contains(param, "powershell"))