Remote Timing Attack in Progress Telerik UI for AJAX

Executive Summary

This vulnerability exists in Progress Telerik UI for AJAX versions prior to v2026.2.708. It involves a flaw in RadAsyncUpload's client-state processing where decrypt failures can be distinguished from invalid-JSON parse failures. This creates a security oracle that allows remote attackers to extract protected metadata values by exploiting timing or error message differences.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of Progress Telerik UI for AJAX. If your system is running a version prior to v2026.2.708, it is vulnerable. No specific commands are provided in the context, but you should verify the installed version against the patched release.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data processed by the application. This includes metadata values that should remain protected, potentially leading to data breaches or information disclosure. The attack requires network access but no authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to protected metadata. Organizations using affected versions may face regulatory penalties, legal liabilities, and reputational damage due to potential data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade In Progress Telerik UI for AJAX to version 2026.2.708 or later to address the RadAsyncUpload client-state processing vulnerability.

Useful 0 Not Useful 0