Zero-Day In Popular jQuery Plugin Actively Exploited For At Least Three Years (zdnet.com)

Slashdot reader generic shares a report from ZDNet: For at least three years, hackers have abused a zero-day in one of the most popular jQuery plugins to plant web shells and take over vulnerable web servers, ZDNet has learned. The vulnerability impacts the jQuery File Upload plugin authored by prodigious German developer Sebastian Tschan, most commonly known as Blueimp. The plugin is the second most starred jQuery project on GitHub, after the jQuery framework itself. It is immensely popular, has been forked over 7,800 times, and has been integrated into hundreds, if not thousands, of other projects, such as CMSs, CRMs, Intranet solutions, WordPress plugins, Drupal add-ons, Joomla components, and so on.

Earlier this year, Larry Cashdollar, a security researcher for Akamai's SIRT (Security Intelligence Response Team), has discovered a vulnerability in the plugin's source code that handles file uploads to PHP servers. Cashdollar says that attackers can abuse this vulnerability to upload malicious files on servers, such as backdoors and web shells. The Akamai researcher says the vulnerability has been exploited in the wild. "I've seen stuff as far back as 2016," the researcher told ZDNet in an interview. The vulnerability was one of the worst kept secrets of the hacker scene and appears to have been actively exploited, even before 2016. Cashdollar found several YouTube videos containing tutorials on how one could exploit the jQuery File Upload plugin vulnerability to take over servers. One of three YouTube videos Cashdollar shared with ZDNet is dated August 2015. Thankfully, the CVE-2018-9206 identifier was pushed earlier this month to address this issue. "All jQuery File Upload versions before 9.22.1 are vulnerable," reports ZDNet. "Since the vulnerability affected the code for handling file uploads for PHP apps, other server-side implementations should be considered safe."

Comments

Not quite as bad as it sounds

[Gavagai80]

The vulnerability is in their PHP code, which is basically sample code. Most projects using the uploader write their own PHP handler for their own specific upload purposes. Only a project that just wants to generically accept all files would consider using their sample PHP code. Verified that my PHP scripts aren't affected despite using the blueimp uploader.

Re:Not quite as bad as it sounds

[Anonymous Coward]

From my understanding, the plugin is very generic, and accepts all files, including PHP scripts and .htaccess files. The idea being that the website developer is supposed to do his own filtering. Of course, some developers will use it blindly and leave this kind of generic file uploader publicly accessible.

Depending on how the code was documented, this is not directly the fault of the plugin developer. 'Seems way overblown in itself. But there sure could be high-profile problematic uses.

Re:This is why

[AC-x]

Yeah the issue is in a PHP script that comes with a popular jQuery plugin to handle the server side part of the file upload system it provides. I think the PHP script in question was written by the same guy as wrote the jQuery plugin, hence the "Javascript developers are crap" parent comment I guess.