Security Vulnerability Alert

One of our third-party suppliers, Telerik, has notified us of a potential security vulnerability affecting RadAsyncUpload, a Telerik control used in some versions of LeavePlanner. Telerik has advised that, in affected configurations, this vulnerability could allow an unauthenticated attacker to gain access to the web hosting server. The attacker does not need to be logged in to LeavePlanner.

We have therefore removed RadAsyncUpload from the LeavePlanner application and replaced it with an in-house upload control.

We strongly advise all Enterprise customers to update to the latest version of LeavePlanner as soon as possible to remove this risk from their installations.

The latest version can be downloaded from here https://help.leaveaplanner.com/downloads/LeavePlannerEnterprise.zip

If an upgrade is not immediately possible, or your Enterprise licence is out of support, we recommend applying the mitigation steps below as soon as possible.

Telerik RadAsyncUpload Mitigation Guidance

Guidance for Enterprise installations where an upgrade is not immediately available.

Who Should Apply This

Apply this guidance if your installation cannot immediately be upgraded or patched. The steps below cover mitigation steps plus an additional handler block to reduce direct exposure of the upload endpoint.

This handler block will prevent uploading of a new logo within the organisation detail page, and also prevent you from importing from Excel files

Before You Start

• Take a backup of the application folder and the current web.config and app.config.
• Make the change during a maintenance window if possible. Saving web.config normally restarts the ASP.NET application.

Step 1 – Hide Detailed Errors Remotely

In web.config, locate the <system.web> section and ensure customErrors is set to either RemoteOnly or On.

<system.web>
  <customErrors mode="On" />
</system.web>

If your file already has a customErrors entry, update the existing entry rather than adding a duplicate.

Step 2 – Set Strong Upload Keys

In the <appSettings> section of app.config, add strong unique values for both Telerik upload keys.

<appSettings>
  <add key="Telerik.AsyncUpload.ConfigurationEncryptionKey"
       value="REPLACE_WITH_STRONG_RANDOM_VALUE_1" />
  <add key="Telerik.Upload.ConfigurationHashKey"
       value="REPLACE_WITH_STRONG_RANDOM_VALUE_2" />
</appSettings>

$bytes = New-Object byte[] 64
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
[Convert]::ToBase64String($bytes)

Step 3 – Move the RadAsyncUpload Temporary Folder

Set the Telerik temporary upload folder to a location outside App_Data. Add this to <appSettings>:

<appSettings>
  <add key="Telerik.AsyncUpload.TemporaryFolder" value="~/UploadTemp" />
</appSettings>

Create the folder in the application root, for example:

ApplicationRoot
  UploadTemp

Grant the application pool identity write permission to this folder. The exact account depends on your IIS configuration, but it is often similar to IIS AppPoolYourApplicationPoolName.

Additional Step – Block RadAsyncUpload Handler Traffic

The Telerik upload handler can often be called directly, without browsing to a page that contains the upload control. If you cannot update the application code, block RadAsyncUpload traffic at IIS, a reverse proxy, or a web application firewall.

Option A – IIS URL Rewrite

If the IIS URL Rewrite module is installed, add these rules inside <system.webServer><rewrite><rules>.

<system.webServer>
  <rewrite>
    <rules>
      <rule name="Block Telerik RadAsyncUpload POST" stopProcessing="true">
        <match url="^Telerik.Web.UI.WebResource.axd$" ignoreCase="true" />
        <conditions logicalGrouping="MatchAll">
          <add input="{REQUEST_METHOD}" pattern="^POST$" ignoreCase="true" />
        </conditions>
        <action type="CustomResponse" statusCode="404"
                statusReason="Not Found" statusDescription="Not Found" />
      </rule>

      <rule name="Block Telerik RadAsyncUpload Query" stopProcessing="true">
        <match url="^Telerik.Web.UI.WebResource.axd$" ignoreCase="true" />
        <conditions logicalGrouping="MatchAny">
          <add input="{QUERY_STRING}" pattern="type=rau|type%3drau|rauPostData|AsyncUpload" ignoreCase="true" />
        </conditions>
        <action type="CustomResponse" statusCode="404"
                statusReason="Not Found" statusDescription="Not Found" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

If your web.config already has a <rewrite> section, add only the two <rule> blocks inside the existing <rules> element.

Option B – IIS Request Filtering Fallback

If URL Rewrite is not installed, you can still block common RadAsyncUpload query-string indicators with request filtering:

<system.webServer>
  <security>
    <requestFiltering>
      <denyQueryStringSequences>
        <add sequence="type=rau" />
        <add sequence="type%3drau" />
        <add sequence="rauPostData" />
        <add sequence="AsyncUpload" />
      </denyQueryStringSequences>
    </requestFiltering>
  </security>
</system.webServer>

This fallback does not block every possible POST to Telerik.Web.UI.WebResource.axd. If URL Rewrite is not available, use your firewall, load balancer, or WAF to block:

POST /Telerik.Web.UI.WebResource.axd

Optional – Remove the Legacy Upload Progress Handler

If your application does not use legacy Telerik upload progress features, remove or comment out these handler entries if present:

<add path="Telerik.RadUploadProgressHandler.ashx"
     type="Telerik.Web.UI.RadUploadProgressHandler"
     verb="*" validate="false" />

<add name="Telerik_RadUploadProgressHandler_ashx"
     path="Telerik.RadUploadProgressHandler.ashx"
     type="Telerik.Web.UI.RadUploadProgressHandler"
     verb="*" preCondition="integratedMode" />

Also remove any anonymous-access <location path="Telerik.RadUploadProgressHandler.ashx"> block if one exists.

Validation

After applying the changes, test the application and confirm the block is active.

• Normal pages should still load.
• Telerik controls that rely on scripts and styles should still render correctly.
• This URL should return 404 or another blocked response: /Telerik.Web.UI.WebResource.axd?type=rau
• A POST request to /Telerik.Web.UI.WebResource.axd should be blocked.

Support Position

These instructions are intended to reduce exposure for installations that cannot immediately be upgraded. They do not replace a supported application release that removes the vulnerable upload functionality.

Document version: 1.0