CVE-2025-3600: Telerik UI for ASP.NET AJAX DoS Flaw

CVE-2025-3600 Overview

CVE-2025-3600 is an unsafe reflection vulnerability discovered in Progress® Telerik® UI for ASP.NET AJAX, affecting versions 2011.2.712 through 2025.1.218. This vulnerability allows attackers to trigger an unhandled exception through unsafe reflection, resulting in a crash of the hosting process and subsequent denial of service.

Critical Impact

Remote attackers can exploit this unsafe reflection flaw to crash web applications built with Telerik UI for ASP.NET AJAX, causing service disruption without requiring authentication or user interaction.

Affected Products

• Progress Telerik UI for ASP.NET AJAX versions 2011.2.712 to 2025.1.218
• Web applications utilizing vulnerable Telerik UI for ASP.NET AJAX components
• ASP.NET web servers hosting applications with affected Telerik assemblies

Discovery Timeline

• May 14, 2025 - CVE-2025-3600 published to NVD
• September 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-3600

Vulnerability Analysis

This vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), commonly known as Unsafe Reflection. The flaw exists within the Telerik UI for ASP.NET AJAX framework where user-controlled input can influence the reflection mechanism used to dynamically instantiate or invoke classes and methods.

When exploited, the unsafe reflection allows an attacker to manipulate the type or method being invoked at runtime. In this specific case, the manipulation leads to an unhandled exception that crashes the hosting IIS worker process (w3wp.exe), effectively taking the web application offline.

The vulnerability is exploitable over the network without requiring any privileges or user interaction, making it particularly dangerous for internet-facing applications.

Root Cause

The root cause lies in improper validation of externally-controlled input that is used to select classes or invoke methods through .NET reflection APIs. The Telerik UI framework processes user-supplied data that influences reflection operations without adequate sanitization or exception handling. When malformed or unexpected input is provided, the reflection operation fails in a manner that propagates an unhandled exception up the call stack, ultimately crashing the application pool.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a web application utilizing vulnerable Telerik UI for ASP.NET AJAX components. The attack requires no authentication and can be executed remotely over the network.

The exploitation process involves:

1. Identifying a target web application using Telerik UI for ASP.NET AJAX
2. Crafting malicious input designed to manipulate the reflection mechanism
3. Sending the payload via HTTP request to trigger the unsafe reflection operation
4. The malformed input causes an unhandled exception during reflection
5. The exception propagates and crashes the IIS worker process

For detailed technical information, refer to the Telerik Security Advisory for CVE-2025-3600.

Detection Methods for CVE-2025-3600

Indicators of Compromise

• Unexpected crashes or restarts of IIS application pools hosting Telerik-based applications
• Windows Event Log entries indicating w3wp.exe crashes with unhandled .NET exceptions
• Spike in HTTP 503 Service Unavailable responses from affected web servers
• Application event logs showing reflection-related exceptions in Telerik assemblies

Detection Strategies

• Monitor IIS application pool health and set alerts for unexpected worker process recycling
• Implement web application firewall (WAF) rules to detect anomalous requests targeting Telerik endpoints
• Review Windows Application Event logs for .NET runtime errors with stack traces involving System.Reflection
• Deploy SentinelOne Singularity Platform to detect and alert on process crashes and anomalous application behavior

Monitoring Recommendations

• Enable detailed IIS logging to capture request patterns preceding application crashes
• Configure application performance monitoring (APM) to track exception rates in Telerik components
• Set up automated alerts for IIS worker process crashes in production environments
• Implement rate limiting on Telerik-specific endpoints to mitigate DoS attempts

How to Mitigate CVE-2025-3600

Immediate Actions Required

• Identify all web applications using Progress Telerik UI for ASP.NET AJAX versions 2011.2.712 to 2025.1.218
• Prioritize patching internet-facing applications that utilize affected Telerik components
• Review web application firewall logs for suspicious activity targeting Telerik endpoints
• Implement request validation rules to filter potentially malicious input

Patch Information

Progress has released a security update to address this vulnerability. Organizations should upgrade to Telerik UI for ASP.NET AJAX version 2025.1.219 or later. Refer to the Telerik Security Advisory for CVE-2025-3600 for official patch information and upgrade guidance.

Workarounds

• Deploy web application firewall (WAF) rules to block malicious requests targeting Telerik components
• Implement application-level request validation to sanitize input before processing
• Configure IIS Rapid-Fail Protection to automatically restart crashed application pools
• Consider temporarily disabling non-essential Telerik features until patching is complete

# Configure IIS application pool rapid-fail protection
# This helps maintain availability by automatically restarting crashed pools
appcmd set apppool /apppool.name:"YourAppPool" /failure.rapidFailProtection:true
appcmd set apppool /apppool.name:"YourAppPool" /failure.rapidFailProtectionInterval:00:05:00
appcmd set apppool /apppool.name:"YourAppPool" /failure.rapidFailProtectionMaxCrashes:5