Dangers of Custom ASP.NET HttpHandlers

This blog post demonstrates a security flaw in Telerik's ASP.NET ChartImage.axd handler where the ImageName parameter is encrypted with AES using a key and IV embedded in Telerik.Web.UI.dll, enabling an attacker who extracts those values to request arbitrary files (which the handler may then delete after download). The post includes decompiled code, affected version information (pre-2011.2.915.35), a proof-of-concept, and a recommendation to update the Telerik.Web.UI.dll to a patched version.