---
id: 4175
title: "CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui"
published_at: "2019-12-12T00:00:00Z"
tags: ["rce", "deserialization", "patching", "telerik", "cve-2019-18935"]
phying_url: "https://phying.com/item/4175"
lang: en
---

# CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI

## Summary

Caleb Gross details CVE-2019-18935: insecure JSON deserialization in Telerik UI for ASP.NET AJAX yields remote code execution; includes the CVE-2017-11317 upload chain and patching.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2019-12-12T00:00:00Z
- **Original:** https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
- **Phying News:** https://phying.com/item/4175