CVE-2024-11629
Published: 12 February 2025
Summary
CVE-2024-11629 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Progress Telerik Document Processing Libraries. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 26.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-11629 is a vulnerability in Progress Telerik Document Processing Libraries, specifically versions prior to 2025 Q1 (2025.1.205) that use .NET Standard 2.0. It enables the export of contents from a file at an arbitrary path into RTF format, classified under CWE-552 (Files or Directories Accessible to External Parties). The issue was published on 2025-02-12 and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
An attacker requires low privileges (PR:L) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation allows reading the contents of arbitrary files by exporting them to RTF, resulting in high confidentiality impact (C:H) through unauthorized data disclosure, minor availability impact (A:L), and no integrity impact (I:N).
The official Telerik advisory provides details on mitigation in their knowledge base article at https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-rtf-filecontent-export-cve-2024-11629. Upgrading to version 2025.1.205 or later resolves the issue in affected libraries.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4662
Vulnerability details
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file read via path traversal/export directly enables collection of data from the local filesystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely remediation through upgrading the Telerik Document Processing Libraries to version 2025.1.205 or later.
Requires validation of file path inputs to the export function to block arbitrary paths and prevent unauthorized file content disclosure to RTF.
Enforces approved access authorizations in the application to restrict reading of arbitrary files, addressing the core access control failure in the vulnerable library.