[jQuery-File-Upload](https://github.com/blueimp/jQuery-File-Upload) 是 Github 上继 jQuery 之后最受关注的 jQuery 项目，该项目最近被披露出一个存在了长达三年之久的任意文件上传漏洞，该漏洞在随后发布的 v9.22.2 版本中被修复，但是在 [VulnSpy](http://www.vulnspy.com/) 团队对代码的复查中发现了另外一个严重的命令执行漏洞，该漏洞允许攻击者通过上传恶意的图片文件来执行任意系统命令。
### 漏洞细节
在 jQuery-File-Upload 的 PHP 上传处理文件 [/server/php/UploadHandler.php](https://github.com/blueimp/jQuery-File-Upload/blob/master/server/php/UploadHandler.php) 中优先使用了 Imagick 来校验上传的图片：
```php
protected function get_image_size($file_path) {
if ($this->options['image_library']) {
if (extension_loaded('imagick')) {
$image = new \Imagick();
try {
if (@$image->pingImage($file_path)) {
$dimensions = array($image->getImageWidth(), $image->getImageHeight());
$image->destroy();
return $dimensions;
}
return false;
} catch (\Exception $e) {
error_log($e->getMessage());
}
}
if ($this->options['image_library'] === 2) {
$cmd = $this->options['identify_bin'];
$cmd .= ' -ping '.escapeshellarg($file_path);
exec($cmd, $output, $error);
if (!$error && !empty($output)) {
// image.jpg JPEG 1920x1080 1920x1080+0+0 8-bit sRGB 465KB 0.000u 0:00.000
$infos = preg_split('/\s+/', substr($output[0], strlen($file_path)));
$dimensions = preg_split('/x/', $infos[2]);
return $dimensions;
}
return false;
}
}
if (!function_exists('getimagesize')) {
error_log('Function not found: getimagesize');
return false;
}
return @getimagesize($file_path);
}
```
我们都知道 ImageMagick 在近几年来出现了多个严重的安全漏洞：
* [More Ghostscript Issues: Should we disable PS coders in policy.xml by default?](https://seclists.org/oss-sec/2018/q3/142)
* [CVE Request - multiple ghostscript -dSAFER sandbox problems](http://seclists.org/oss-sec/2016/q4/29)
* [CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability via filename](https://seclists.org/oss-sec/2016/q2/432)
因此我们可已直接通过上传含有恶意代码的图片来利用该漏洞，按照老规矩，[VulnSpy](http://www.vulnspy.com/) 已经准备好了在线的实验环境，大家可以移步到下面链接进行测试：
**在线测试地址：[https://www.vulnspy.com/cn-jquery-file-upload-below-v9.x-rce/](https://www.vulnspy.com/cn-jquery-file-upload-below-v9.x-rce/)**
### 如何修复
将 [/server/php/UploadHandler.php](https://github.com/blueimp/jQuery-File-Upload/blob/286f25ce9646b7f699110ef877e346930b1b9cad/server/php/UploadHandler.php#L131) 中的默认图片处理库修改为GD库：
```php
// Set to 0 to use the GD library to scale and orient images,
// set to 1 to use imagick (if installed, falls back to GD),
// set to 2 to use the ImageMagick convert binary directly:
'image_library' => 0
```
**本文转载自：[jQuery-File-Upload <= 9.x 远程命令执行漏洞 (ImageMagick/Ghostscript)](https://blog.vulnspy.com/2018/10/23/jQuery-File-Upload-9-x-Remote-Code-Execution-With-ImageMagick-Ghostscript-CN/)**
### 参考
* [Remote code execution vulnerability in the PHP component](https://github.com/blueimp/jQuery-File-Upload/blob/master/VULNERABILITIES.md#remote-code-execution-vulnerability-in-the-php-component)
