CVE-2024-11343 Overview
CVE-2024-11343 is a path traversal vulnerability in Progress Telerik Document Processing Libraries. The flaw exists in versions prior to 2025 Q1 (2025.1.205). Unzipping a crafted archive can lead to arbitrary file system access outside the intended extraction directory. An authenticated attacker with low privileges can exploit this over the network to compromise confidentiality, integrity, and availability of the host application.
The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Progress has published a security advisory and a fixed release.
Critical Impact
A malicious ZIP archive can write files to arbitrary locations, enabling code overwrite, configuration tampering, or data exfiltration in applications that consume untrusted archives.
Affected Products
- Progress Telerik Document Processing Libraries, all versions prior to 2025 Q1 (2025.1.205)
- .NET applications embedding the Telerik ZIP archive components
- Server-side services performing archive extraction via the affected libraries
Discovery Timeline
- 2025-02-12 - CVE-2024-11343 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11343
Vulnerability Analysis
The vulnerability resides in the archive extraction routines of the Telerik Document Processing Libraries. When the library unpacks a ZIP archive, it does not properly validate entry names against directory traversal sequences. An attacker who supplies an archive containing entries such as ..\..\Windows\System32\file.dll can cause the extractor to resolve paths outside the target directory.
Exploitation requires the target application to process an attacker-influenced archive. Because the affected code path executes with the privileges of the host process, files can be created or overwritten wherever the application has write access. This can lead to remote code execution when writable paths intersect with executables, scheduled task definitions, startup folders, or web application binaries.
The CWE-22 classification aligns with the classic "Zip Slip" pattern documented across multiple archive-handling libraries.
Root Cause
The extractor concatenates archive entry names to the destination path without canonicalizing the result or rejecting traversal segments. Entries containing .. separators or absolute path prefixes therefore escape the intended extraction root.
Attack Vector
An authenticated attacker submits a crafted ZIP archive to a workflow that invokes Telerik document processing. Typical entry points include document import features, template upload endpoints, and report ingestion services. On extraction, the library writes attacker-controlled content to arbitrary paths, enabling follow-on compromise.
No verified public exploit code has been published for CVE-2024-11343. The vulnerability mechanism follows the standard Zip Slip pattern. Refer to the Telerik Security Advisory CVE-2024-11343 for vendor-provided technical details.
Detection Methods for CVE-2024-11343
Indicators of Compromise
- Files written to unexpected locations by the process hosting Telerik libraries, particularly outside the configured archive extraction directory.
- Presence of ZIP archives on disk containing entries with ..\ or ../ sequences or absolute path prefixes.
- New or modified executables, DLLs, or configuration files in application, web root, or startup directories following document processing activity.
Detection Strategies
- Inventory application dependencies for Telerik.Windows.Zip and related Document Processing assemblies below version 2025.1.205.
- Inspect archive contents server-side before extraction and flag entries whose normalized path escapes the extraction root.
- Correlate file creation events by application processes with recent archive upload or import events.
Monitoring Recommendations
- Enable file integrity monitoring on web roots, plugin directories, and OS auto-start locations used by servers hosting Telerik-based applications.
- Log all archive upload endpoints and record entry names extracted, retaining data for incident response.
- Alert on process writes that traverse outside expected working directories for services that consume user-supplied documents.
How to Mitigate CVE-2024-11343
Immediate Actions Required
- Upgrade Progress Telerik Document Processing Libraries to version 2025.1.205 (2025 Q1) or later across all applications and build pipelines.
- Audit application code that calls Telerik archive extraction APIs and restrict inputs to trusted sources until patching completes.
- Rotate credentials and review file integrity on any server that processed untrusted archives with a vulnerable version.
Patch Information
Progress addressed the issue in Telerik Document Processing Libraries 2025 Q1 (2025.1.205). Update the NuGet package or referenced assemblies to the fixed version and redeploy affected applications. See the Telerik Security Advisory CVE-2024-11343 for release details.
Workarounds
- Validate each archive entry by resolving its full path and confirming it starts with the intended extraction directory before writing.
- Reject archives containing entries with .., absolute paths, or drive letters prior to invoking the extractor.
- Run document processing services under least-privilege accounts with write access restricted to a dedicated, isolated directory.
# Configuration example: verify installed package version
dotnet list package | Select-String "Telerik.Windows.Documents"
# Ensure version >= 2025.1.205
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
