A fix is out but the plugin is used in hundreds, if not thousands, of projects. Patching will take ages!
For at least three years, hackers have abused a zero-day in one of the most popular jQuery plugins to plant web shells and take over vulnerable web servers,
ZDNet has learned.
The vulnerability impacts the
jQuery File Upload plugin authored by prodigious German developer Sebastian Tschan, most commonly known as Blueimp.
The plugin is the second most starred jQuery project on GitHub, after the jQuery framework itself. It is immensely popular, has been forked over 7,800 times, and has been integrated into hundreds, if not thousands, of other projects, such as CMSs, CRMs, Intranet solutions, WordPress plugins, Drupal add-ons, Joomla components, and so on.
A vulnerability in this plugin would be devastating, as it could open gaping security holes in a lot of platforms installed in a lot of sensitive places.
