TGViewer
The Bug Bounty Hunter The Bug Bounty Hunter @thebugbountyhunter · 51K subscribers
Post #10681 8.09K
From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/
Tanto Security From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.
  • ❤ 7
  • 🔥 6
Open in Telegram All posts from @thebugbountyhunter
More from @thebugbountyhunter
  1. Sep 22, 2026SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Typ…
  2. Sep 20, 2026BragJack [Technical Overview]: How We Hijacked Top 5 Browsers' Internal Agents With Just O…
  3. Sep 19, 2026ROOT Tesla OS on QEMU Part 2 :Debugging + fixing https://cn0xroot.wordpress.com/2026/09/20…
  4. Sep 19, 2026ROOT Tesla OS on QEMU Part 1 :unpacking https://cn0xroot.wordpress.com/2026/09/19/root-tes…
  5. Sep 19, 2026geminiHunter Find and assess exposed Google Gemini API keys in web assets and Android apps…
  6. Sep 18, 2026Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain https://pwn.ai/bl…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →