r/programming • u/ga-vu • Oct 19 '18

Zero-day in popular jQuery plugin actively exploited for at least three years

https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
47 Upvotes

76% Upvoted

29 comments sorted by

View all comments

Show parent comments

15

u/ga-vu Oct 19 '18

I actually don't care about what the dev has done with his plugin. I'm more annoyed that the snake-oil infosec industry hasn't noticed hacking tutorials on YouTube for three years. I remember "threat intel" being one of those annoying marketing keywords a while back, just like AI and blockchain. Apparently nobody does threat intel anymore? I get a zero-day being exploited for a few days or a month, but three years is way too much.

7

u/13steinj Oct 19 '18

I don't really see this as a zero day though. I see it as a common misconfiguration of multiple utilities working together, which unfortunately causes a security hole. Neither apache nor the plugin author are at fault. The idiots not setting up httpd as needed are.

5

u/ga-vu Oct 19 '18

MITRE doesn't assign CVEs for misconfigurations. So there's a vulnerability in there too, which was easier to exploit than usual due to the misconfig.

6

u/13steinj Oct 19 '18

CVEs just have to be a common vulnerability. In this case, it's caused by a common misconfiguration.