Telerik Document Processing Path Traversal

The core impact of CVE-2024-11343 lies in its ability to enable arbitrary file system access. An attacker could leverage this vulnerability to read sensitive configuration files, source code, or even execute malicious code on the server hosting the application. The blast radius extends to any data accessible by the user account under which the document processing library is running. Successful exploitation could lead to data breaches, system compromise, and potential denial of service. This vulnerability shares similarities with other archive-based path traversal exploits, where specially crafted archive entries can bypass security checks and access unauthorized files.

Applications that utilize the Telerik Document Processing Libraries to process user-supplied archive files are at risk. This includes web applications, desktop applications, and any other software that integrates with the library. Organizations using older, unpatched versions of the library, particularly those with limited patching cycles, are at higher risk.

• .NET / dotnet: Use Sysinternals Process Monitor to observe file access patterns when processing archives. Look for attempts to access files outside of the expected application directory.

Get-Process | Where-Object {$_.ProcessName -like '*Telerik*'} | Get-Process -Id $PID | ForEach-Object {
  Get-WinEvent -LogName Application -Filter "*[System[Provider[@Name='Microsoft-Windows-Sysinternals-ProcessMonitor']]]*"
}

• .NET / dotnet: Examine application logs for errors related to file access or archive processing. Look for exceptions indicating path traversal attempts. • .NET / dotnet: Review code that handles archive processing for potential vulnerabilities. Ensure proper path sanitization and validation are implemented. • .NET / dotnet: Windows Defender ATP can be configured to detect suspicious process behavior related to file access. Create a custom detection rule based on the known vulnerable library and file access patterns.

1. 2025-02-12Disclosure

   disclosure

1. Reserviert2024-11-18
2. Veröffentlicht2025-02-12
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-11343 is to upgrade to version 2025.1.205 or later of the Telerik Document Processing Libraries. If immediate upgrading is not feasible, consider implementing input validation and sanitization on archive files before processing them. Specifically, restrict the types of files allowed and validate their contents to prevent malicious entries. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious archive file extensions or patterns. After upgrading, verify the fix by attempting to unzip a known malicious archive file and confirming that access is denied.