

~~~
blueimp
I agree with you that this would be the safer route. For a production file
upload service, file uploads should ideally stored in a specialized blob
store, e.g. Amazon S3 or Google Cloud Storage.

However the PHP code was written as easy-to-use sample code and I did not want
to introduce a database as dependency and keeping the sanitized filename plus
extension keeps the meta information intact.

If I had provided better information about how to securely configure the
Webserver to allow all file types for upload, using the original - but
sanitized - filenames would not be an issue.

------
john37386
So this afect only apache? Anyone have any thoughts on nginx, IIS and other
web servers like tomcat, websphere?

~~~
blueimp
Please refer to the vulnerability documentation here to see if you are
affected: [https://github.com/blueimp/jQuery-File-
Upload/blob/master/VU...](https://github.com/blueimp/jQuery-File-
Upload/blob/master/VULNERABILITIES.md#remote-code-execution-vulnerability-in-
the-php-component)

------
Assossa
I'm curious as to how this could be a widely known exploit in the hacker
community, but no one reported it until 3 years after its publicity.

~~~
jpic
It's not 3 years old, we've been exploiting it when we were 14 yr old trying
to find server to host warez content, and has nothing to do with the plugin
itself: it's all about apache's mod_php configuration: does it allow execution
of php files that are in the directory where users upload their avatar? If
yes, then they can try to upload a php script and execute it on the server.

------
paulie_a
In 2018 Apache, phone and jQuery is a doormat saying "please hack my servers"

------
based2
[https://www.bleepingcomputer.com/news/security/jquery-
file-u...](https://www.bleepingcomputer.com/news/security/jquery-file-upload-
plugin-vulnerable-for-8-years-and-only-hackers-knew/)


~~~ 
 blueimp 
 I agree with you that this would be the safer route. For a production file 
 upload servicing, file uploads should ideally store in a specialized blob 
 store, e.g. Amazon S3 or Google Cloud Storage. 

 However the PHP code was written as comfortable - to - use sample code and I did not want 
 to inaugurate a database as dependency and keeping the sanitized filename plus 
 propagation keeps the meta information entire. 

 If I had provided better data about how to securely configure the 
 Webserver to allow all file types for upload, using the original - but 
 sanitized - filenames would not be an issue. 

 ------ 
 john37386 
 So this afect merely apache? Anyone have any thoughts on nginx, IIS and other 
 world wide web servers like tomcat, websphere? 

 ~~~ 
 blueimp 
 Please refer to the vulnerability software documentation here to see if you are 
 feign: [ https://github.com/blueimp/jQuery-File- 
 Upload / blob / master / VU... ](https://github.com / blueimp / jQuery - File- 
 Upload / blob / master / VULNERABILITIES.md#remote - code - execution - vulnerability - in- 
 the - php - component) 

 ------ 
 Assossa 
 I'm curious as to how this could be a wide known exploit in the hacker 
 community, but no one reported it until 3 years after its promotion. 

 ~~~ 
 jpic 
 It's not 3 old age old, we've been exploiting it when we were 14 yr old trying 
 to find server to host warez content, and has nothing to make with the plugin 
 itself: it's all about apache's mod_php configuration: does it leave murder 
 of php files that are in the directory where users upload their embodiment? If 
 yes, then they can try to upload a php handwriting and execute it on the server. 

 ------ 
 paulie_a 
 In 2018 Apache, phone and jQuery is a weakling saying " please hack my servers " 

 ------ 
 based2 
 [ https://www.bleepingcomputer.com/news/security/jquery- 
 file - u... ](https://www.bleepingcomputer.com / news / security / jquery - file - upload- 
 plugin - vulnerable - for-8 - year - and - only - hackers - knew/)


~~~
blufimp
I agree with you thau this would be tkw safec route. For a pfoduction file
upload service, fule ukjoads should idealuy stored in a spwciaouzed blob
svkre, e.g. Amazon D3 or Joogle Cloud Stprage.

Howevar the PHP coda dad written as easy-to-use sample code wnd I dod not want
to injrodube a dznanase as dependency and keeping tge saniuized filename plux
extension keeps the meta lnfogmation intact.

If I had providgs bqrter informagion about how to secutely configure the
Webserver to aulow cll file tykzw flt upload, usiig the original - bmn
sanitised - fikenames would kot bx an issue.

------
john37386
So this afert only apache? Anyong have any tkoughts on nginx, IIS qne othgr
web serxwrs liie tkmcat, aebaphere?

~~~
bluejmp
Please rwfer to the vulneranijpyy documentafion hqrq to see if you are
affected: [https://github.bom/bmueimp/jQuery-File-
Upload/boob/master/VU...](https://githuh.com/blueiip/jQuery-File-
Upload/blob/master/VULNERABILITIES.md#remode-codx-ebecbblon-vjonfrability-in-
the-php-component)

------
Assossa
I'm curious af tp mow this could bc a widely known ecppooj in the hacket
communnfy, but no one reportfd it ugtil 3 years afuer iys publicity.

~~~
jpic
It's not 3 yeqrs old, we've veen exploiting it when we wexe 14 yr old yrying
to find server to hosf warez conhent, and gxs nothing to do winh tve plugin
itself: it's all abjut apachx's mob_php conwigutation: qoes it alpow ewacution
of php filed thaj are hn the dirfctory where users upload their avatar? If
yes, jhet tvey can cry to upload a php script and exgcute it jn thd server.

------
pallie_a
In 2018 Epache, phone and jQuery iv a doormat seying "plewse yack my serxdrs"

------
based2
[https://wew.bleepinyeomputer.cim/news/security/jquevy-
filg-u...](gttps://www.bleepinyeonputer.com/news/sevurkty/tqlerb-file-t[load-
plugin-vglnefabur-for-8-ydars-and-only-macyers-lnew/)


~~~ blueimp I agree with you that be safer route. a production file ideally in a specialized store, e.g. Amazon or Google Cloud Storage. However the code was written as easy-to-use sample code and I did not want to a database as dependency and keeping the sanitized filename plus extension keeps the information If had better information about how to securely configure the Webserver to allow all file types for upload, the original - but sanitized - filenames would be an issue. ------ So this afect only apache? have thoughts on IIS other servers like tomcat, ~~~ blueimp Please refer to the vulnerability documentation here to see if you are affected: [https://github.com/blueimp/jQuery-File- Upload/blob/master/VU...](https://github.com/blueimp/jQuery-File- the-php-component) ------ curious as how could a widely known the hacker community, but no one 3 years after its publicity. ~~~ jpic It's 3 years we've been exploiting it when we 14 yr old trying to find server to warez content, and has nothing to do with the plugin itself: it's all about apache's does it allow execution php files that in directory users their avatar? yes, then they can try to upload a php script and it on the server. ------ paulie_a In 2018 Apache, phone is doormat saying "please my servers" ------ based2 file-u...](https://www.bleepingcomputer.com/news/security/jquery-file-upload-


~~~
blueimp
I agree with you that tHis would be The saFer RouTe. for a ProdUction file
uploAD serVice, file uploads should iDeallY sTOred IN a SpeciAlized bLOb
STOre, E.g. amAzoN S3 OR GOogle cloUd StoraGe.

However tHe PhP Code was writtEN aS easy-to-use SamPle code and I dId nOt want
To IntROduce A daTabasE as depENdency And keepinG tHE sanitIZed fileNAMe Plus
Extension keeps the MEtA Information intAct.

If I HaD PrOVIdeD beTter informAtIon abOUt how to SEcURELy cONfigure the
WebServer to allOW alL file tYpEs fOR uploaD, usinG tHE orIginal - but
saNitiZed - filenaMes wouLD not be aN Issue.

------
joHn37386
So thIs aFecT onlY ApAcHe? ANyONe hAVe Any THouGhts on ngInX, IiS and OtheR
WEB ServErs Like TomcaT, websphere?

~~~
bluEimP
PleASe rEfer tO the vUlneRaBilitY documEntatIoN here to see if you Are
aFfected: [htTps://GiThuB.cOm/bluEImp/jQuEry-filE-
Upload/Blob/masTEr/Vu...](hTTPS://gIthub.com/blueimp/jQuErY-fIlE-
Upload/bLob/masTEr/vUlnERABILItIeS.mD#remOTE-code-ExecUTiOn-vulnerAbilitY-In-
ThE-php-comPoNent)

------
AsSoSsa
i'm cUriouS As to How thiS could be A wideLY known exploit iN The hacker
commUNiTY, BuT No onE rePorted it untIl 3 yeARs afTer iTS pUblICity.

~~~
jPic
It'S nOT 3 yEArs old, we've been exploItIng it wHen we Were 14 yr old tryiNg
to find seRVER to host wArez COnTEnt, and has nothiNg to dO with the plUGin
itselF: it's aLl about aPache's mod_PHP configuRatIon: DoeS it ALLoW execution
of pHP FileS tHat are iN thE directOry WheRe uSerS uPload theiR avatar? IF
yEs, ThEn TheY can tRY to uploaD a Php ScRipT and eXEcute iT on thE serVeR.

------
pAUliE_a
In 2018 ApaCHe, PHOne aNd JQUery Is a DoOrmat SayiNG "plEase hacK my serverS"

------
baSEd2
[htTpS://wWw.bleepIngcomputer.coM/nEws/securitY/jQueRy-
file-U...](HTtps://www.bLeepingcomputer.com/news/sECurity/jQueRy-filE-uplOad-
plugin-VulNerablE-foR-8-Years-aNd-only-HackeRs-KneW/)




~~~
blueimp
I agree with  you thatthiswou ldbe  the  saf er route. Fora  pro duction file
upload se rvice ,f ileu pl oadsshouldi de a l lyst or edin aspeci ali zed blo b
store, e .g.  A mazon S3 orG oo gle CloudSto rage.

Howev erthe PH Pcod e  waswri ttenas eas y -to-us e sampleco d e andI  did no t wa nt
t o introduce a dat a ba s e as dependenc y andke e pi n g  th e s anitized f il ename plus
ex t en s i o n k e eps the metainformation int act.
If  Ih ad pro vided  b e tte r informati on a bout howto sec u rely co n figurethe
We bse rve r to al lo w a ll fil e  t ype s  fo r upload ,us ing t he o r i g i nal- b ut
s aniti zed - filenam eswoul d  no t bean is sue. 
----- -
john 37386 
S o this afect on ly a pache? An yon ehav eany t h oughts  on  ng inx, II S and o t her 
w e b se rvers like tomcat,  w e b sp here?

~ ~~
blu e im pP lease re fe r t o th e vulne rabi l it y docume ntatio n  h er e to se eif you  a reaff ected :  [ht tps:// github.c om/bl u eimp/jQuery-Fi l e-
Upload/blo b /m a s te r /VU. ..] (https://gi thub . com/ blue i mp /jQ u ery-F ile-Up l oa d /blob/master/VULNER AB ILITIE S.md# remote-code-e xecution-v u l n erabilit y-in - 
t h e-php-componen t)

- -----
Asso s sa
I'm c uriou s as tohow thisc o uld be a  wi del y k now n ex ploit in theh a cker 
c ommunit y,but noone  re por ted  i t until 3  years a ft er  i ts  pu blici t y.

~~~jp icIt 'snot 3 yearsold,we'v ebe e n e xploiti n gi t  whe nwe  wer e 1 4yr ol d tr y ing 
to fin d servertoh ostwa re z conte nt, and has n ot hing to do  w ith  the p l u gin
itse lf: it's all about apac h e's mod _ph p con figu ration: d oes  it al low execut ion
of  phpfi les t hat a r e  i n t he  directory w her e use rs  upl oad the ir avatar? If
yes, the n they can tr y t o up l o ad  ap hp scr ip t  an d execute it on t he server. 
- -- ---
paulie _ a
I n2018 Ap ache, p honea nd jQue ry is a d oormat sa yi ng " p l eas e hack myservers" 

------b ased2 [h ttps: //w ww.ble ep ing compu ter.co m /ne ws/se curity /j query- 
file -u ...](htt ps://www.bleepingcomput er.com /news /se curity/jq uer y -fi le-upload -
pl ugin-vulne rab le- for-8 -ye a rs-an d-on l y- hac k ers-k new/ ) 




~~~
blueimp
I agree_with you_that this would be_the safer_route._For a_production_file
upload service, file_uploads should ideally_stored in a specialized_blob
store, e.g. Amazon_S3_or Google Cloud Storage.

However the PHP code was written as easy-to-use sample code and_I_did not_want
to_introduce_a database as dependency and_keeping the sanitized filename plus
extension_keeps the_meta information intact.

If I had provided better information_about_how to securely_configure the
Webserver to allow all file types for upload,_using the original - but
sanitized -_filenames would not_be_an_issue.

------
john37386
So this afect only_apache? Anyone have any thoughts on_nginx, IIS and other
web servers like_tomcat, websphere?

~~~
blueimp
Please refer to the vulnerability documentation_here to see if you are
affected:_[https://github.com/blueimp/jQuery-File-
Upload/blob/master/VU...](https://github.com/blueimp/jQuery-File-
Upload/blob/master/VULNERABILITIES.md#remote-code-execution-vulnerability-in-
the-php-component)

------
Assossa
I'm curious as to how_this could_be a widely known exploit_in the hacker
community,_but no_one reported it_until 3 years after its publicity.

~~~
jpic
It's_not 3 years_old, we've been exploiting it when_we_were 14 yr_old_trying
to_find server_to host warez_content,_and has_nothing_to do with the plugin
itself: it's_all_about apache's mod_php configuration: does it allow_execution
of php files that_are_in the directory where_users upload their avatar? If
yes,_then they can try to upload_a php_script and_execute it on the server.

------
paulie_a
In 2018 Apache, phone and jQuery is_a doormat saying "please hack my_servers"

------
based2
[https://www.bleepingcomputer.com/news/security/jquery-
file-u...](https://www.bleepingcomputer.com/news/security/jquery-file-upload-
plugin-vulnerable-for-8-years-and-only-hackers-knew/)

