telerik: overhaul, native RAU + DialogHandler crypto - #3333
Conversation
Refactor into per-technique async methods, replace RAU_crypto.py subprocess loop with native badsecrets-primitive payload builder. Add CVE-2017-9248 oracle probe (dp_cryptomg quick_check port) and DialogHandler known-key spray (PBKDF1_MS + PBKDF2 via badsecrets keylists). Standardize FINDING name values on CVE + handler. Config: exploit_rau (renamed from exploit_RAU_crypto), try_known_keys, probe_dialoghandler_oracle, include_machinekeys. Deps: drop deps_ansible + pycryptodome, add badsecrets.
Replace KDF-fingerprint shortcut for the DialogHandler oracle probe with the actual dp_cryptomg find_baseline algorithm: iterate the 3^4 byte combinations of [0x00, 0x6b, 0x08] as GET ?dp=<b64> payloads and read for 'Index was outside the bounds of the array' / 'String was not recognized as a valid Boolean'. On hit, emit CRITICAL/CONFIRMED. Reorder DH exploit: try known-key spray first (definitive, recovers the actual keys); only fall back to the byte-oracle baseline probe if no key matches. Oracle probe is gated to PBKDF1_MS mode since the CVE-2017-9248 patch moved to PBKDF2 specifically to defeat it. DialogHandler discovery tries the default path (Telerik.Web.UI. DialogHandler.aspx at root) sequentially first; the handler is global and this produces a less confusing finding URL. Only fan out to the extended candidate list if the default misses.
Detect CVE-2017-11317 exploitability without uploading a file. Send default-keys payloads targeting a fake assembly version (9999.9.999); if the server responds with 'Could not load file or assembly', crypto succeeded and .NET rejected the bogus version before any file write. Emit HIGH/HIGH 'Telerik RAU Default Keys Accepted' finding. Try each (KDF, HMAC) combination pre-patch targets can use: PBKDF1_MS no-HMAC (pre-2017), PBKDF1_MS with HMAC (2017.1.118 - 2018.1.117), PBKDF2 with HMAC (2018.2+). First hit exits. exploit_rau=True still runs the full version iteration for the CRITICAL/CONFIRMED RCE finding; version identification and RCE confirmation are the same operation. Fix: version fingerprint used to send version 2014.3.1024, a real Telerik version. On a target actually running that version, that was an accidental file upload during 'default' scanning.
The safe fake-version probe already detects RAU exploitability by default; this opt-in specifically identifies the exact installed version by uploading a benign 1-byte file. Old name misrepresented its role. Description now warns explicitly about the file write.
Safe RAU probe now sprays the full badsecrets keylist (not just the two hardcoded defaults), split into Default vs Known findings by key source. Version list picks up badsecrets' patched set + undotted variants; adopts quoted Version="X" and lowercase C:\\windows\\temp\\ per badsecrets. custom_secrets wired through. rau_confirm_version defers HIGH until version-check runs — CRITICAL alone on match, HIGH fallback (with attempted-but-failed wording) on miss. Verbose step messages throughout. dotnet-audit preset uses rau_confirm_version.
Post-patch DialogHandlers validate input length before touching crypto, so the short AAAA fingerprint probe returns 'Invalid length for a Base-64' regardless of the actual KDF. Real known-key probes are long enough to pass that gate, so spray PBKDF1_MS then PBKDF2 when the classifier can't tell. Catches weak-custom-key configs on hardened targets that would otherwise fall through with no attempt.
badsecrets sees the same string and silently keeps its initial PBKDF1_MS default; it's an input-length gate, not a patch signal. Returning None makes the exploit path try both KDFs (my prior change), which is strictly more coverage than badsecrets' PBKDF1_MS-only fallback.
dp_cryptomg does no KDF classification before find_baseline — it just tries the byte oracle and reads response strings. My PBKDF1_MS-only gate skipped legitimate oracle-vulnerable targets whose short KDF-fingerprint probe was rejected by an input-length gate (kdf_mode = None). Only skip when the classifier explicitly reported PBKDF2 (where the CVE-2017-9248 patch fixed the oracle by design).
Add DialogHandler version detection using the recovered hash/enc keys (safe, size-diff probe, mirrors badsecrets' DialogHandler.probe_version). Emit follows the RAU pattern: CRITICAL/CONFIRMED with version, HIGH/HIGH fallback when target's version isn't in the candidate list. Thread RAU-confirmed version through to DH oracle + known-key findings. Both handlers back onto the same Telerik.Web.UI install, so an RAU-confirmed version fills in the DH side when DH can't identify it directly (strong custom DH keys). Also fix DH known-key test mock to model version detection correctly (assembly type string is base64-encoded inside the plaintext) and assert CRITICAL + version in the finding.
_rau_confirmed set added nothing on top of _incoming_dedup_hash: URL events dedupe per-netloc (default) or per-normalized-URL (include_subdirs), and either way the same base_url can't reach _probe_rau twice. Also: rename stale exploit_rau -> rau_confirm_version in a test message and add missing f-string prefix on another.
📊 Performance Benchmark Report
📈 Detailed Results (All Benchmarks)
🎯 Performance Summary+ 1 improvement 🚀
30 unchanged ✅🔍 Significant Changes (>10%)
🐍 Python Version 3.11.15 |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev #3333 +/- ##
======================================
- Coverage 90% 90% -0%
======================================
Files 450 450
Lines 46308 46656 +348
======================================
+ Hits 41565 41862 +297
- Misses 4743 4794 +51 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
singlerider
left a comment
singlerider
left a comment
There was a problem hiding this comment.
First pass on the rewrite at 979d116. Dropping the RAU_crypto shell-out is a real win: it removes a git-clone build dep and a subprocess per probe. CI green across 3.10 to 3.14 and all seven distros. I verified the crypto and the RAU probe posture rather than trusting the diff, findings below.
🟢 Native RAU crypto reproduces the shell-out exactly
This was the part most likely to silently break, so I checked it against the reference the shell-out used. _rau_encrypt's c + "\x00" interleave plus chr(pad)*pad is UTF-16LE + PKCS7, and it matches base64(AES-CBC(pad(pt.encode("utf-16-le"), 16))) byte for byte with the PBKDF1_MS-derived key and IV. The default RAU keys are the documented CVE-2017-11317 constants, and the KDF derivation is delegated to badsecrets, not reimplemented. This is correct.
One nit, not blocking: c + "\x00" equals UTF-16LE only for code points below U+0100. The only plaintext through this path is the hardcoded ASCII temp path, so it is fine today, but if a non-ASCII folder ever gets fed in the ciphertext will be silently wrong rather than raising. pt.encode("utf-16-le") would be the same result for the current input and immune to that. Your call.
🟢 The file-upload path is gated correctly
rau_confirm_version defaults False, it only runs after the safe fake-version key spray (_probe_rau_known_keys) has already proven the keys with a 9999.9.999 assembly that fails to load before any write, and the WARNING in the config text names the 1-byte write to C:\\windows\\temp\\. Emitting a HIGH keys-accepted finding when confirmation is disabled, and only escalating to CRITICAL/CONFIRMED on an actual fileInfo response, is the right severity ladder. A destructive confirmation being opt-in and gated behind a non-destructive proof is exactly the posture I want to see here.
The CRITICAL RAU RCE emitting as a FINDING rather than a VULNERABILITY matches what the old module did at the removed block, so this preserves convention rather than introducing drift. Not raising it.
🟢 Oracle fallback and known-key spray are ordered sensibly
Known-key spray first (definitive, recovers the actual keys), byte-oracle only as a fallback when the spray misses, and the oracle gated on PBKDF1_MS since that is the only mode it works against. probe_dialoghandler_oracle defaulting True is reasonable for a non-destructive probe. The version list dedupes via dict.fromkeys and the undotted-variant rationale is documented.
Approving. The one crypto nit is a latent edge, not a blocker.
2 participants
Summary
Rewrite of the
telerikmodule.rau_cryptoshell-out; AES-CBC done natively.9999.9.999assembly version, flags exploitable RAU without writing a file. Opt-inrau_confirm_versionwalks candidate versions and uploads a 1-byte file on match for CRITICAL.badsecretstelerik_knownkeyfor known-key spray on DialogHandler (PBKDF1_MS + PBKDF2).dp_cryptomg(find_baseline, 81-combo?dp=...probe) as a fallback when known-key spray misses.dotnet-auditpreset opts intorau_confirm_version+include_subdirs.