Executive brief
Plupload is a popular JavaScript file upload library used in web applications. A vulnerability allowed attackers to upload files with JavaScript code in the filename, which would then be executed in the browser. This could lead to session hijacking, credential theft, or malicious actions performed on behalf of legitimate users, but requires social engineering to trick a user into uploading a malicious file.
Technical details
The vulnerability is a code injection flaw (CWE-434, CWE-75) in plupload versions before 2.3.9, where filenames containing JavaScript code are not properly sanitized before being displayed in the DOM. When a file with malicious code in its filename is uploaded, the code executes in the context of the uploading user's browser session. The attack requires user interaction—specifically, tricking a user to upload the malicious file—and is not remotely exploitable without social engineering. The fix involves proper HTML entity encoding of filename strings before DOM insertion, as demonstrated in commit d12175d.
Affected products
- Moxiecode Plupload before 2.3.9
Timeline
- 2021-12-16: disclosed
- 2021-12-03: patched: Version 2.3.9 released with fix