Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: SANS.edu Internet Storm Center - SANS Internet Storm Center SANS.edu Internet Storm Center


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

Attacker Scanning for jQuery-File-Upload

Published: 2022-05-23
Last Updated: 2022-05-23 13:35:52 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Recently, I noticed some requests hitting our honeypots that appear to attempt to exploit jQuery-File-Upload. jQuery-File-Upload is a popular tool for implementing file uploads. It has been around for a while and has had a few vulnerabilities in the past, but nothing recent as far as I can tell [1]. Allowing users to upload files securely is tricky. And jQuery-File-Upload is tempting faith by allowing uploads into the document root. The walk-through by Kristian Bremberg explaining past jQuery-File-Upload vulnerabilities is an excellent summary of all the things that can go wrong [2].

Here is a typical request we are seeing currently:
 

GET /jqueryupload/server/php/index.php?file=tf2rghf.jpg HTTP/1.1
Accept: */*
User-Agent: ALittle Client
Host: [redacted]
Content-Type: application/json
Content-Length: 0
Connection: Keep-Alive

 

There are a couple of odd things identifying this set of scans:

  • While the attacker attempts some variations of the URL, the image file name is always the same
  • the user-agent is unique to this particular attacker (more about that later).
  • The hostname is an actual hostname assigned to the target IP in the past. This attacker does appear to scan a list of hostnames, not a list of IPs.
  • No actual exploit is sent. This appears to be an attempt to find vulnerable systems.

The scans are currently all coming from 194.38.20.161. The IP address has been active since the beginning of the year. Over that time, different URLs were scanned with a focus on file upload vulnerabilities:

  • /sites/all/libraries/elfinder/src/connectors/php/connector.php
  • /assets/plugins/fileuploader/examples/one-button/php/form_upload.php
  • /assets/admin/plugins/plupload/examples/upload.php
  • /open_flash_chart/php-ofc-library/ofc_upload_image.php
  • /wp-content/plugins/advanced_file_manager_5/files/_elghoul.php

The very first request we saw with this user-agent arrived on August 9th last year and attempted to access the WordPress file manager. Back then, the requests came from a few different IP addresses.

Sadly, we do not know exactly what the attacker is attempting to upload. But it will likely be spam/malware, which is what we often find. The attacker is scanning by hostname instead of IP address as the attacker is likely looking for existing websites with a "decent" reputation to minimize the chance of blocklisting. If you are a developer: Read the blog linked below for a refresher on what can go wrong with file uploads.

[1] https://github.com/blueimp/jQuery-File-Upload/blob/master/VULNERABILITIES.md
[2] https://blog.detectify.com/2018/12/13/jquery-file-upload-a-tale-of-three-vulnerabilities/

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

1 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

A 'Zip Bomb' to Bypass Security Controls & Sandboxes
May 20th 2022
3 days ago by Xme (0 comments)

Bumblebee Malware from TransferXL URLs
May 20th 2022
3 days ago by Brad (0 comments)

Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign...
May 18th 2022
5 days ago by Jan (0 comments)

Use Your Browser Internal Password Vault... or Not?
May 17th 2022
6 days ago by Xme (0 comments)

View All Diaries →

Latest Discussions

Dshield Sensor
created Jun 8th 2021
11 months ago by Rick (0 replies)

API port data
created Apr 25th 2021
1 year ago by JJ (1 reply)

RSS feed containing non-XML compatible characters
created Apr 14th 2021
1 year ago by Anonymous (1 reply)

Handler's Diary (Full text) RSS Feeds stopt working due to a typo
created Mar 5th 2021
1 year ago by bas.auer@auerplace.nl (0 replies)

port_scan issue in Snort3
created Feb 23rd 2021
1 year ago by astraea (0 replies)

View All Forums →

Latest News

Top Diaries

Mixed VBA & Excel4 Macro In a Targeted Excel Sheet
Jan 22nd 2022
4 months ago by Xme (0 comments)

A Quick CVE-2022-21907 FAQ
Jan 14th 2022
4 months ago by Johannes (0 comments)

Method For String Extraction Filtering
Apr 9th 2022
1 month ago by DidierStevens (0 comments)

CinaRAT Delivered Through HTML ID Attributes
Feb 11th 2022
3 months ago by Xme (0 comments)

Obscure Wininet.dll Feature?
Jan 21st 2022
4 months ago by Xme (0 comments)