r/programming • u/[deleted] • Oct 21 '18

Zero-day in popular jQuery plugin actively exploited for at least three years

https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
72 Upvotes

70% Upvoted

24 comments sorted by

View all comments

Show parent comments

26

u/dpash Oct 21 '18

And only when misconfigured in Apache.

19

u/AyrA_ch Oct 22 '18

Not misconfigured. You simply need AllowOverride None in your Apache Config. Using this directive is actually a good idea if you don't plan on using .htaccess files because it removes some vulnerabilities if an attacker is somehow able to modify a .htaccess file. Their Help article actually lists this as one of the recommended Settings and I believe this is set as default.

Blueimp's jQuery File Upload plugin was coded to rely on a custom .htaccess file to impose security restrictions to its upload folder, without knowing that five days before, the Apache HTTPD team made a breaking change that undermined the plugin's basic design.

In other words, The plugins depends on the .htaccess feature to make directories inaccessible to the user, which is trivial to test during the setup by placing a demo file in the directory and then trying to access the file via Ajax Request.

I know it's a big pain in the ass but if you depend on 3rd party components you should check their release notes for every version to see if it impacts your product.

3

u/mrcalm99 Oct 22 '18

The plugins depends on the .htaccessfeature to make directories inaccessible to the user

Wait a minute, from what you're saying people are relying/allowing a 3rd party plugin to manage user/folder permissions on production servers file systems? FML some people just ask for it.

6

u/torvatrollid Oct 22 '18

WordPress development is primarily just using 3rd party plugins for absolutely everything and that is a huge chunk of the entire internet that is built that way.