Executive brief
jquery-file-upload is a JavaScript library that enables file uploads in web applications. Versions up to 4.0.2 contain a vulnerability that allows attackers to upload arbitrary files without type restrictions, potentially leading to remote code execution or malicious file distribution through the affected web server.
Technical details
This is an unrestricted file upload vulnerability (CWE-434) in jquery-file-upload versions <= 4.0.2. The library fails to properly validate uploaded file types, allowing attackers to bypass file type restrictions and upload dangerous executables or scripts. The vulnerability requires only network access with no authentication or user interaction needed. An attacker can upload malicious files (e.g., PHP shells, executables) that the server will process, leading to remote code execution or compromise of the hosting environment. The vulnerability was fixed in version 4.0.5.
Affected products
- jquery-file-upload <= 4.0.2
Timeline
- 2018-12-19: disclosed
- 2018-12-19: patched: Fixed in version 4.0.5