Executive brief
jQuery-Upload-File is a popular JavaScript plugin that enables multiple file uploads with a progress bar on web applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts through specially crafted file names, which could be used to steal user sessions, redirect users to phishing sites, or perform unauthorized actions on behalf of legitimate users.
Technical details
This is a DOM-based cross-site scripting (CWE-79) vulnerability in jQuery-Upload-File affecting version 4.0.11 and earlier versions. The vulnerable code is located in the fileNameStr parameter handling in jquery.uploadfile.js (line 469), where user-supplied file names are not properly sanitized or escaped before being inserted into the DOM. An attacker can upload a file with a malicious JavaScript payload embedded in the file name; when the plugin processes and displays the file name without proper HTML encoding, the script executes in the browser context of any user viewing the upload interface. This requires user interaction (viewing the upload interface) but no authentication. The attack has network reach and can lead to session hijacking, credential theft, or malware distribution. A patch should be available in versions after 4.0.11.
Affected products
- hayageek jquery-upload-file through 4.0.11
Timeline
- 2022-02-25: disclosed
- 2022-02-26: advisory