Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day in jQuery plugin sample code exploited for at least three years

zdnet.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#41

Post by DCoder »

pdkl95 wrote: post #34
blueimp wrote: post #4

Author of jQuery File Upload here. The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component. To give you some context on how this could happen: - As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file - Over tim…

> Never allow all file types for upload by default, even if it is secure in your configuration The general form - never use default-allow - should be used in most situations where set of possible inputs cannot be exhaustively enumerated. In most situations, you cannot enumerate badness[1]. Instead of trying to define valid input by specifying it's inverse, it's far simpler (and safer) to use default-deny and specify…

Also known as "use a whitelist instead of a blacklist".

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#42

Post by galori »

yebyen wrote: post #14

OK. I'll be that guy. Is there nobody who is going to talk about Larry Cashdollar, the person who discovered this vulnerability and first reported it? I'm honestly not sure how I'd be more impressed; if you told me this man actually uses this as his real name in his daily life, or by finding out that this is actually his birth name.

https://news.ycombinator.com/item?id=18271880

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#43

Post by femto113 »

quickthrower2 wrote: post #32
blueimp wrote: post #4

Author of jQuery File Upload here. The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component. To give you some context on how this could happen: - As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file - Over tim…

"Zero-day in popular jQuery plugin" is a bit misleading for the title then. More like "Zero-day in copy pasted code in PHP if apache incorrectly configured".

I think the title is substantially misleading in that it suggests the bug is in the plugin itself. Maybe "Zero-day in PHP server sample code provided with popular jQuery plugin"?

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#45

Post by fulafel »

What other vulnerabilities did this backwards-incompatible Apache change cause? Probably many people rely on .htaccess, for example to disable access to non-public files or disable php execution on a DIY CMS file sharing area.

Sounds like the risk from this is not widely known. Probably the correct solution for Apache would have been to detect presence of now-ignored .htaccess files and signal an error.

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#46

Post by lawnchair_larry »

willeh wrote: post #7
blueimp wrote: post #4

Author of jQuery File Upload here. The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component. To give you some context on how this could happen: - As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file - Over tim…

I really don't blame the author here, sure there was an issue with the sample code - but come on it was sample code. If someone is implementing user uploads they should really do the due diligence and understand what the sample code does. To be honest I'm not really that surprised that the vulnerability stayed hidden for so long; many PHP users are hobbyists or come from a more traditional "webmaster" background. Thi…

Not a good way to look at it. Sample code is equivalent to production code. It will be copied, verbatim, if it appears to work. Once it has the appearance of working, it isn’t looked at again. It doesn’t matter if you think people should be doing this or not. The only thing that matters is they will.

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#47

Post by xab9 »

Isn't this a click-baitish title? I would say that this is a configuration issue and not "exactly" a vulnerability and basically get off my lawn.

Reading blueimp's and larry's comments here I envy their constructivity, open mindedness and professionalism.

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#48

Post by vbezhenar »

willeh wrote: post #7
blueimp wrote: post #4

Author of jQuery File Upload here. The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component. To give you some context on how this could happen: - As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file - Over tim…

I really don't blame the author here, sure there was an issue with the sample code - but come on it was sample code. If someone is implementing user uploads they should really do the due diligence and understand what the sample code does. To be honest I'm not really that surprised that the vulnerability stayed hidden for so long; many PHP users are hobbyists or come from a more traditional "webmaster" background. Thi…

Understanding what the code does is not how people generally write software. They slap components together, copy&paste examples and randomly move code lines around until it seems to work good enough. So your examples better be correct :)

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#49

Post by svat »

yebyen wrote: post #14

OK. I'll be that guy. Is there nobody who is going to talk about Larry Cashdollar, the person who discovered this vulnerability and first reported it? I'm honestly not sure how I'd be more impressed; if you told me this man actually uses this as his real name in his daily life, or by finding out that this is actually his birth name.

It appears to be a somewhat common surname. Looking up Wikipedia, there is Cindy Cashdollar (a musician), and a few others: https://en.wikipedia.org/w/index.php?search=Cashdollar+-%22C...

Re: Zero-day in jQuery plugin sample code exploited for at least three years

#50

Post by geggo98 »

blueimp wrote: post #4

Author of jQuery File Upload here. The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component. To give you some context on how this could happen: - As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file - Over tim…

There is no blame on you. There is no way you can provide a configuration that will be secure on every server.

My recommendation: add a big warning message that there is at least one known security hole and many unknown ones in the server code and it is up to the just to secure their server properly.

Then fix the demo code but leave the warning there.

It's always up to the developers to check the system they build for security problems. They could use the best frameworks in the world and copy thoro reviewed example code. The end result might still have huge security problems.

Post reply on HN