Skip to content

Commit d3f323f

Browse files
committed
Add security guidelines and list of fixed vulnerabilities.
1 parent 07917e6 commit d3f323f

3 files changed

Lines changed: 145 additions & 2 deletions

File tree

README.md

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
# jQuery File Upload Plugin
22

3-
## ⚠️ Versions Before 9.22.1 are Vulnerable
3+
## ⚠️ Security Notice
4+
Security related releases:
45

5-
A serious exploit, [CVE-2018-9206](https://nvd.nist.gov/vuln/detail/CVE-2018-9206), exists in versions released before October 2018. [[MISC](http://www.vapidlabs.com/advisory.php?v=204)]
6+
* [v9.22.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.22.1) Fixes a [Remote code execution vulnerability in the PHP component](VULNERABILITIES.md#remote-code-execution-vulnerability-in-the-php-component).
7+
* v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) Fixes an [Open redirect vulnerability in the GAE components](VULNERABILITIES.md#open-redirect-vulnerability-in-the-gae-components).
8+
* Commit [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) (*fixed in all tagged releases*) Fixes a [Cross-site scripting vulnerability in the Iframe Transport](VULNERABILITIES.md#cross-site-scripting-vulnerability-in-the-iframe-transport).
9+
10+
Please read the [SECURITY](SECURITY.md) document for instructions on how to securely configure your Webserver for file uploads.
611

712
## Demo
813
[Demo File Upload](https://blueimp.github.io/jQuery-File-Upload/)
@@ -12,6 +17,9 @@ File Upload widget with multiple file selection, drag&drop support, progress
1217
Supports cross-domain, chunked and resumable file uploads and client-side image resizing. Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads.
1318

1419
## Setup
20+
⚠️ **Notice:**
21+
Please read the [Security recommendations](SECURITY.md) before setting up the project.
22+
1523
* [How to setup the plugin on your website](https://github.com/blueimp/jQuery-File-Upload/wiki/Setup)
1624
* [How to use only the basic plugin (minimal setup guide).](https://github.com/blueimp/jQuery-File-Upload/wiki/Basic-plugin)
1725

SECURITY.md

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# File Upload Security
2+
For an in-depth understanding of the potential security risks of providing file uploads and possible mitigations, please refer to the [OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) documentation.
3+
4+
To securely setup the project to serve uploaded files, please refer to the sample [Secure file upload serving configurations](#secure-file-upload-serving-configurations).
5+
6+
By default, all sample upload handlers allow only upload of image files, which mitigates some attack vectors, but should not be relied on as the only protection.
7+
8+
Please also have a look at the [list of fixed vulnerabilities](VULNERABILITIES.md) in jQuery File Upload.
9+
10+
## Mitigations against file upload risks
11+
12+
### Prevent code execution on the server
13+
To prevent execution of scripts or binaries on server-side, the upload directory must be configured to not execute files in the upload directory (e.g. `server/php/files` as the default for the PHP upload handler) and only treat uploaded files as static content.
14+
15+
The recommended way to do this is to configure the upload directory path to point outside of the web application root.
16+
Then the Webserver can be configured to serve files from the upload directory with their default static files handler only.
17+
18+
Limiting file uploads to a whitelist of safe file types (e.g. image files) also mitigates this issue, but should not be the only protection.
19+
20+
### Prevent code execution in the browser
21+
To prevent execution of scripts on client-side, the following headers must
22+
be sent when delivering generic uploaded files to the client:
23+
24+
```
25+
Content-Type: application/octet-stream
26+
X-Content-Type-Options: nosniff
27+
```
28+
29+
The `Content-Type: application/octet-stream` header instructs browsers to display a download dialog instead of parsing it and possibly executing script content e.g. in HTML files.
30+
31+
The `X-Content-Type-Options: nosniff` header prevents browsers to try to detect the file mime type despite the given content-type header.
32+
33+
For known safe files, the content-type header can be adjusted using a **whitelist**, e.g. sending `Content-Type: image/png` for PNG files.
34+
35+
### Prevent distribution of malware
36+
To prevent attackers from uploading and distributing malware (e.g. computer viruses), it is recommended to limit file uploads only to a whitelist of safe file types.
37+
38+
Please note that the detection of file types in the sample file upload handlers is based on the file extension and not the actual file content. This makes it still possible for attackers to upload malware by giving their files an image file extension, but should prevent automatic execution on client computers when opening those files.
39+
40+
It does not protect at all from exploiting vulnerabilities in image display programs, nor from users renaming file extensions to inadvertently execute the contained malicious code.
41+
42+
## Secure file upload serving configurations
43+
44+
### Apache config
45+
Add the following directive to the Apache config, replacing the directory path with the absolute path to the upload directory:
46+
47+
```ApacheConf
48+
<Directory "/path/to/project/server/php/files">
49+
# To enable the Headers module, execute the following command and reload Apache:
50+
# sudo a2enmod headers
51+
52+
# The following directives prevent the execution of script files
53+
# in the context of the website.
54+
# They also force the content-type application/octet-stream and
55+
# force browsers to display a download dialog for non-image files.
56+
SetHandler default-handler
57+
ForceType application/octet-stream
58+
Header set Content-Disposition attachment
59+
60+
# The following unsets the forced type and Content-Disposition headers
61+
# for known image files:
62+
<FilesMatch "(?i)\.(gif|jpe?g|png)$">
63+
ForceType none
64+
Header unset Content-Disposition
65+
</FilesMatch>
66+
67+
# The following directive prevents browsers from MIME-sniffing the content-type.
68+
# This is an important complement to the ForceType directive above:
69+
Header set X-Content-Type-Options nosniff
70+
</Directory>
71+
```
72+
73+
### NGINX config
74+
Add the following directive to the NGINX config, replacing the directory path with the absolute path to the upload directory:
75+
76+
```Nginx
77+
location ^~ /path/to/project/server/php/files {
78+
root html;
79+
default_type application/octet-stream;
80+
types {
81+
image/gif gif;
82+
image/jpeg jpg;
83+
image/png png;
84+
}
85+
add_header X-Content-Type-Options 'nosniff';
86+
if ($request_filename ~ /(((?!\.(jpg)|(png)|(gif)$)[^/])+$)) {
87+
add_header Content-Disposition 'attachment; filename="$1"';
88+
# Add X-Content-Type-Options again, as using add_header in a new context
89+
# dismisses all previous add_header calls:
90+
add_header X-Content-Type-Options 'nosniff';
91+
}
92+
}
93+
```

VULNERABILITIES.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# ⚠️ List of fixed vulnerabilities
2+
3+
## Remote code execution vulnerability in the PHP component
4+
> Fixed: 2018-10-13
5+
6+
The sample [PHP upload handler](server/php/index.php) before [v9.22.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.22.1) allowed to upload all file types by default.
7+
This opens up a remote code execution vulnerability, unless the server is configured to not execute (PHP) files in the upload directory (`server/php/files`).
8+
9+
The provided [.htaccess](server/php/files/.htaccess) file includes instructions for Apache to disable script execution, however [.htaccess support](https://httpd.apache.org/docs/current/howto/htaccess.html) is disabled by default since Apache `v2.3.9` via [AllowOverride Directive](https://httpd.apache.org/docs/current/mod/core.html#allowoverride).
10+
11+
**You are affected if you:**
12+
1. Uploaded jQuery File Upload `version < 9.22.1` on a Webserver that executes all PHP scripts in the project directory, e.g. Apache with `mod_php` enabled.
13+
2. Did not actively configure your Webserver to not execute files in the upload directory (`server/php/files`).
14+
3. Are running Apache `v2.3.9+` with the default `AllowOverride` Directive set to `None` or another Webserver with no `.htaccess` support.
15+
16+
**How to fix it:**
17+
1. Upgrade to the latest version of jQuery File Upload or limit file uploads to image file types - see [sample PHP code](server/php/index.php).
18+
2. Configure your Webserver to not execute files in the upload directory, e.g. with the [sample Apache configuration](SECURITY.md#apache-config)
19+
20+
**Further information:**
21+
* Commit containing the security fix: [aeb47e5](https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f)
22+
* [Full disclosure post on Hacker News](https://news.ycombinator.com/item?id=18267309).
23+
* [CVE-2018-9206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9206)
24+
* [OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload)
25+
26+
## Open redirect vulnerability in the GAE components
27+
> Fixed: 2015-06-12
28+
29+
The sample Google App Engine upload handlers before v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) accepted any URL as redirect target, making it possible to use the Webserver's domain for phishing attacks.
30+
31+
**Further information:**
32+
* Commit containing the security fix: [f74d2a8](https://github.com/blueimp/jQuery-File-Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f)
33+
* [OWASP - Unvalidated Redirects and Forwards Cheat Sheet](https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet)
34+
35+
## Cross-site scripting vulnerability in the Iframe Transport
36+
> Fixed: 2012-08-09
37+
38+
The [redirect page](cors/result.html) for the [Iframe Transport](js/jquery.iframe-transport.js) before commit [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) (*fixed in all tagged releases*) allowed executing arbitrary JavaScript in the context of the Webserver.
39+
40+
**Further information:**
41+
* Commit containing the security fix: [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a)
42+
* [OWASP - Cross-site Scripting (XSS)](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS))

0 commit comments

Comments
 (0)