infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clarify vuln (re)discovery vs. disclosure 

https://www.bleepingcomputer.com/news/security/jquery-file-upload-plugin-vulnerable-for-8-years-and-only-hackers-knew/
GSoC/Meterpreter_Web_Console
William Vu 2018-10-23 02:39:11 -05:00
parent b4bdc52597
commit a55f7ff30a
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
documentation/modules/exploit/unix/webapp/jquery_file_upload.md
View File

@ -6,6 +6,9 @@ handler for blueimp's jQuery File Upload widget in versions <= 9.22.0.
Due to a default configuration in Apache 2.3.9+, the widget's `.htaccess` Due to a default configuration in Apache 2.3.9+, the widget's `.htaccess`
file may be disabled, enabling exploitation of this vulnerability. file may be disabled, enabling exploitation of this vulnerability.
This vulnerability has been exploited in the wild since at least 2015
and was publicly disclosed to the vendor in 2018.
## Setup ## Setup
<https://github.com/blueimp/jQuery-File-Upload/wiki/Setup#using-jquery-file-upload-ui-version-on-php-websites> <https://github.com/blueimp/jQuery-File-Upload/wiki/Setup#using-jquery-file-upload-ui-version-on-php-websites>

7
modules/exploits/unix/webapp/jquery_file_upload.rb
View File

@ -19,9 +19,12 @@ class MetasploitModule < Msf::Exploit::Remote
Due to a default configuration in Apache 2.3.9+, the widget's .htaccess Due to a default configuration in Apache 2.3.9+, the widget's .htaccess
file may be disabled, enabling exploitation of this vulnerability. file may be disabled, enabling exploitation of this vulnerability.
This vulnerability has been exploited in the wild since at least 2015
and was publicly disclosed to the vendor in 2018.
}, },
'Author' => [ 'Author' => [
'Larry W. Cashdollar', # Discovery and PoC 'Larry W. Cashdollar', # Advisory and PoC
'wvu' # Metasploit module 'wvu' # Metasploit module
], ],
'References' => [ 'References' => [
@ -30,7 +33,7 @@ class MetasploitModule < Msf::Exploit::Remote
['URL', 'https://github.com/blueimp/jQuery-File-Upload/pull/3514'], ['URL', 'https://github.com/blueimp/jQuery-File-Upload/pull/3514'],
['URL', 'https://github.com/lcashdol/Exploits/tree/master/CVE-2018-9206'] ['URL', 'https://github.com/lcashdol/Exploits/tree/master/CVE-2018-9206']
], ],
'DisclosureDate' => 'Oct 9 2018', 'DisclosureDate' => 'Oct 9 2018', # Public disclosure
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Platform' => ['php', 'linux'], 'Platform' => ['php', 'linux'],
'Arch' => [ARCH_PHP, ARCH_X86, ARCH_X64], 'Arch' => [ARCH_PHP, ARCH_X86, ARCH_X64],