Skip to main content

jQuery File Upload Vulnerability

A vulnerability has been disclosed in the File Upload widget, a popular jQuery framework plugin. The researchers who discovered the vulnerability claim it could be exploited by a remote attacker to upload arbitrary files to an affected web server.
Threat ID:
CC-2744
Category:
Threat Severity:
Medium
Threat Vector:
Published:
25 October 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A vulnerability has been disclosed in the File Upload widget, a popular jQuery framework plugin. The researchers who discovered the vulnerability claim it could be exploited by a remote attacker to upload arbitrary files to an affected web server.

Threat details

The vulnerability appears to have been caused by a change introduced in Apache 2.3.9, released in 2010. This version disabled user access to the .htaccess files, used to store folder-related security settings, in order to improve performance and protect server configurations. Plugins that used the .htaccess files, such as File Upload, could no longer take advantage of these custom security settings.

At the time of publication, there are approximately 8000 publicly available projects and applications using File Upload variants.

For further information:

Remediation steps

Type Step
The developer of the jQuery File Upload plugin has confirmed that this vulnerability has been addressed in version 9.24.1. Users and administrators are encouraged to apply this update immediately

CVE Vulnerabilities

Status

CVE-2018-9206

Last edited: 17 February 2020 12:46 pm