CVE-2024-10095: Telerik UI for WPF RCE Vulnerability

CVE-2024-10095 Overview

CVE-2024-10095 is a critical insecure deserialization vulnerability affecting Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213). This vulnerability allows remote attackers to achieve code execution through maliciously crafted serialized objects, potentially leading to complete system compromise without requiring authentication or user interaction.

Critical Impact

Remote attackers can exploit this insecure deserialization flaw to execute arbitrary code on systems running vulnerable Telerik UI for WPF applications, potentially gaining full control of affected systems.

Affected Products

• Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213)
• Applications built using vulnerable Telerik UI for WPF components
• Windows systems hosting WPF applications with affected Telerik libraries

Discovery Timeline

• 2024-12-16 - CVE-2024-10095 published to NVD
• 2024-12-18 - Last updated in NVD database

Technical Details for CVE-2024-10095

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a well-known vulnerability class that occurs when applications deserialize data from untrusted sources without proper validation. In the context of Telerik UI for WPF, the vulnerability allows attackers to craft malicious serialized payloads that, when processed by the application, result in arbitrary code execution.

Insecure deserialization vulnerabilities in .NET applications are particularly dangerous because the .NET serialization framework can instantiate arbitrary types and invoke methods during the deserialization process. Attackers can leverage known "gadget chains" within the .NET framework or third-party libraries to construct payloads that execute arbitrary commands when deserialized.

Root Cause

The root cause of this vulnerability lies in the unsafe handling of serialized data within Telerik UI for WPF components. The application fails to properly validate or sanitize serialized objects before deserialization, allowing attackers to inject malicious object graphs that trigger code execution through .NET's serialization mechanisms. This type of vulnerability typically occurs when:

• Applications accept serialized data from untrusted sources
• No type filtering or validation is applied to deserialized objects
• The serialization format supports arbitrary type instantiation (such as BinaryFormatter or similar formatters)

Attack Vector

The attack vector for CVE-2024-10095 is network-based, meaning attackers can exploit this vulnerability remotely without requiring local access to the target system. The attack does not require authentication or user interaction, making it highly exploitable. An attacker would typically:

1. Identify an application using a vulnerable version of Telerik UI for WPF
2. Craft a malicious serialized payload containing gadget chains
3. Send the payload to an endpoint that processes serialized data
4. Upon deserialization, the malicious payload executes arbitrary code with the privileges of the application

Due to the sensitive nature of this vulnerability and the absence of verified proof-of-concept code, specific exploitation details are not provided. Administrators should consult the Telerik Security Advisory CVE-2024-10095 for technical details about the vulnerability and remediation steps.

Detection Methods for CVE-2024-10095

Indicators of Compromise

• Unusual process spawning from WPF applications using Telerik UI components
• Unexpected network connections initiated by Telerik-based applications
• Anomalous PowerShell, cmd.exe, or other shell processes spawned as child processes of affected applications
• Signs of serialized .NET payloads in network traffic or application logs

Detection Strategies

• Monitor application logs for deserialization exceptions or errors that may indicate exploitation attempts
• Implement network traffic analysis to detect suspicious serialized payloads targeting WPF applications
• Deploy endpoint detection solutions capable of identifying .NET deserialization attack patterns
• Conduct regular vulnerability scans to identify systems running affected Telerik UI for WPF versions

Monitoring Recommendations

• Enable detailed logging for applications using Telerik UI for WPF components
• Configure SIEM rules to alert on suspicious process chains originating from WPF applications
• Monitor for unexpected file system modifications in directories used by affected applications
• Implement application whitelisting to prevent unauthorized code execution

How to Mitigate CVE-2024-10095

Immediate Actions Required

• Upgrade Telerik UI for WPF to version 2024 Q4 (2024.4.1213) or later immediately
• Inventory all applications using Telerik UI for WPF to identify vulnerable deployments
• Implement network segmentation to limit exposure of applications that cannot be immediately patched
• Review and restrict network access to endpoints that may process serialized data

Patch Information

Progress has released a security update addressing this vulnerability in Telerik UI for WPF version 2024 Q4 (2024.4.1213). Organizations should prioritize upgrading to this version or later to remediate the vulnerability. Detailed patch information and upgrade guidance is available in the Telerik Security Advisory CVE-2024-10095.

Workarounds

• If immediate patching is not possible, consider temporarily disabling or isolating affected applications
• Implement strict input validation on any endpoints that may receive serialized data
• Deploy web application firewalls (WAF) or intrusion prevention systems (IPS) with rules to detect serialized payload attacks
• Restrict network access to affected applications using firewall rules or network access control lists

# Example: Restrict network access to vulnerable application port
# Windows Firewall rule to limit access to trusted IPs only
netsh advfirewall firewall add rule name="Restrict Telerik WPF App" dir=in action=block protocol=tcp localport=YOUR_APP_PORT
netsh advfirewall firewall add rule name="Allow Trusted Telerik WPF" dir=in action=allow protocol=tcp localport=YOUR_APP_PORT remoteip=TRUSTED_IP_RANGE