flame-11/CVE-2018-9206-jquery-file-upload

GitHubRepository PoCExploit

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that uploads a PHP file to a vulnerable jQuery-File-Upload instance and then requests the uploaded file to confirm remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (Dockerfile, README.md, scripts/poc.sh) set up a vulnerable environment and provide a proof-of-concept script for CVE-2018-9206. The PoC uploads a benign PHP file containing a timestamped marker and verifies its execution. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access is observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesShell
Target softwareBlueimp jQuery-File-Upload
Attack typesUnrestricted File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP file and then executes it to confirm code execution, which constitutes exploitation rather than mere detection or scanning.

scripts/poc.sh:12-13scripts/poc.sh:19scripts/poc.sh:21-22

Requirements

  • A running instance of Blueimp jQuery-File-Upload <= 9.22.0 with the default upload endpoint accessible.scripts/poc.sh:5scripts/poc.sh:12-13

Observed behavior

  • Sends a POST request to the server's PHP upload handler with a file containing PHP code.scripts/poc.sh:12-13
  • Checks the server response for the uploaded filename to confirm successful upload.scripts/poc.sh:15
  • Requests the uploaded PHP file via HTTP to trigger its execution on the server.scripts/poc.sh:19
  • Compares the HTTP response body to a unique marker string to confirm remote code execution.scripts/poc.sh:21-22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Context
CVE-2018-9206The artifact is a lab environment and PoC for a known arbitrary file upload vulnerability in Blueimp jQuery-File-Upload.README.md:1-3
Poc Behavior
Uploads a PHP file with a unique marker and checks for its executionThe PoC script demonstrates the vulnerability by uploading a harmless PHP file and verifying RCE, which is standard exploit demonstration behavior.scripts/poc.sh:6-22
Review boundaries

What the analysis did not establish

  • Only three of nine repository files were provided as text; the remaining six files (including the vulnerable application code) were omitted.
  • The analysis is based solely on static review of the provided text; the code was not executed, and its behavior in a live environment is not verified.
  • 6 files in the repository are not included in the text evidence; their content is unknown.
  • The analysis is limited to static review of the provided text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2018-9206Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a PHP 7.2 Apache container hosting a vulnerable instance of Blueimp jQuery-File-Upload 9.22.0, intended for demonstrating CVE-2018-9206 (unrestricted file upload).

docker-compose.yml:1-10Dockerfile:1-24README.md:1-52

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Vulnerable Docker environment for CVE-2018-9206', the Dockerfile disables .htaccess to simulate a vulnerable configuration, and a PoC script is provided to demonstrate the exploit.

README.md:1-3Dockerfile:8-9scripts/poc.sh:1-33
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable targetPHP application server

A service built from the Dockerfile, running php:7.2-apache with the jQuery-File-Upload application copied into /var/www/html/jQuery-File-Upload/. It exposes port 80, mapped to host port 8888. The Apache configuration is modified to disable .htaccess parsing (AllowOverride None), which is the condition that makes the unrestricted file upload exploitable.

docker-compose.yml:4-9Dockerfile:1-24

jQuery-File-Upload application

vulnerable applicationfile upload handler

The Blueimp jQuery-File-Upload 9.22.0 application, consisting of an HTML frontend (app/index.html) and a PHP backend (app/server/php/index.php and UploadHandler.php). The backend accepts file uploads via POST to /server/php/index.php and stores them in /server/php/files/. The default configuration accepts any file type (accept_file_types => '/.+$/i'), allowing PHP file uploads.

app/index.html:1-250app/server/php/index.php:1-15app/server/php/UploadHandler.php:1-1411app/package.json:1-55

PoC script

exploit demonstrationvalidation tool

A bash script (scripts/poc.sh) that uploads a PHP file containing a unique marker to the target, then fetches the uploaded file to confirm remote code execution. It accepts an optional target URL, defaulting to http://localhost:8888.

scripts/poc.sh:1-33
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2018-9206

Supported by supplied evidence

The environment explicitly targets CVE-2018-9206. The Dockerfile disables .htaccess (AllowOverride None) to create the vulnerable condition, the application version is 9.22.0 (within the affected range), and the PoC script demonstrates unrestricted upload of a PHP file leading to code execution.

README.md:1-3Dockerfile:8-9app/package.json:3scripts/poc.sh:1-33
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:7-9
  • The target application must be accessible at the specified URL (default http://localhost:8888).scripts/poc.sh:5README.md:11
  • The attacker must be able to send HTTP POST requests to the upload endpoint and GET requests to the uploaded file location.scripts/poc.sh:11-18

Evidence-described exercise path

  1. Build and start the vulnerable environment using 'docker compose up -d --build'.README.md:7-9
  2. Upload a PHP file (e.g., containing '<?php echo "CVE-2018-9206-PWNED"; ?>') to the upload endpoint via POST.README.md:15-17scripts/poc.sh:11-12
  3. Access the uploaded PHP file via GET request to execute the code and confirm remote code execution.README.md:19-21scripts/poc.sh:16-18
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target container. The PoC script uploads and executes a PHP file within the container to demonstrate the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab exercise.

scripts/poc.sh:1-33docker-compose.yml:1-10Dockerfile:1-24
Review boundaries

What the analysis did not establish

  • The .gitignore file is present but its content is not included in the evidence, though it is unlikely to affect the assessment.
  • The analysis is based solely on static file content; no runtime behavior was observed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1