SANS ISC: SANS.edu Internet Storm Center - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS.edu Internet Storm Center

Recently, I noticed some requests hitting our honeypots that appear to attempt to exploit jQuery-File-Upload. jQuery-File-Upload is a popular tool for implementing file uploads. It has been around for a while and has had a few vulnerabilities in the past, but nothing recent as far as I can tell [1]. Allowing users to upload files securely is tricky. And jQuery-File-Upload is tempting faith by allowing uploads into the document root. The walk-through by Kristian Bremberg explaining past jQuery-File-Upload vulnerabilities is an excellent summary of all the things that can go wrong [2].

Here is a typical request we are seeing currently:
 

GET /jqueryupload/server/php/index.php?file=tf2rghf.jpg HTTP/1.1
Accept: */*
User-Agent: ALittle Client
Host: [redacted]
Content-Type: application/json
Content-Length: 0
Connection: Keep-Alive

 

There are a couple of odd things identifying this set of scans:

• While the attacker attempts some variations of the URL, the image file name is always the same
• the user-agent is unique to this particular attacker (more about that later).
• The hostname is an actual hostname assigned to the target IP in the past. This attacker does appear to scan a list of hostnames, not a list of IPs.
• No actual exploit is sent. This appears to be an attempt to find vulnerable systems.

The scans are currently all coming from 194.38.20.161. The IP address has been active since the beginning of the year. Over that time, different URLs were scanned with a focus on file upload vulnerabilities:

• /sites/all/libraries/elfinder/src/connectors/php/connector.php
• /assets/plugins/fileuploader/examples/one-button/php/form_upload.php
• /assets/admin/plugins/plupload/examples/upload.php
• /open_flash_chart/php-ofc-library/ofc_upload_image.php
• /wp-content/plugins/advanced_file_manager_5/files/_elghoul.php

The very first request we saw with this user-agent arrived on August 9th last year and attempted to access the WordPress file manager. Back then, the requests came from a few different IP addresses.

Sadly, we do not know exactly what the attacker is attempting to upload. But it will likely be spam/malware, which is what we often find. The attacker is scanning by hostname instead of IP address as the attacker is likely looking for existing websites with a "decent" reputation to minimize the chance of blocklisting. If you are a developer: Read the blog linked below for a refresher on what can go wrong with file uploads.

[1] https://github.com/blueimp/jQuery-File-Upload/blob/master/VULNERABILITIES.md
[2] https://blog.detectify.com/2018/12/13/jquery-file-upload-a-tale-of-three-vulnerabilities/

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|